@tearleads/client-sdk 0.1.63 → 0.1.64

package/workflows/container-contents/container-state/create/createWithMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWithMetadata.js","sourceRoot":"","sources":["createWithMetadata.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,GACtB,MAAM,2CAA2C,CAAC;AAMnD,OAAO,EAAE,wCAAwC,EAAE,MAAM,4DAA4D,CAAC;AAEtH,OAAO,EAAE,wCAAwC,EAAE,MAAM,8CAA8C,CAAC;AAExG,OAAO,EACL,uDAAuD,EACvD,iCAAiC,GAClC,MAAM,uEAAuE,CAAC;AAE/E,OAAO,EAEL,uCAAuC,GACxC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAEL,0CAA0C,EAC1C,wCAAwC,EACxC,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAK7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EACL,+BAA+B,GAEhC,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAG/E,KAAK,UAAU,mCAAmC,CAAC,KAKlD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,yCAAyC,CACtE,KAAK,CAAC,OAAO,EACb;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;KACpB,CACF,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oCAAoC,CAAC,KAMnD;IACC,MAAM,UAAU,GAAG,0CAA0C,CAAC;QAC5D,mBAAmB,EAAE,KAAK,CAAC,eAAe;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,gBAAgB;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,wCAAwC,CAAC,UAAU,EAAE;YACzD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,6BAA6B,CACnD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,EAClC,UAAU,CACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAC,KAU/C;IACC,MAAM,cAAc,GAAG,wCAAwC,CAC7D,KAAK,CAAC,oBAAoB,EAC1B,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAChC,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,wCAAwC,CAAC;QACnE,IAAI,EAAE,KAAK,CAAC,aAAa;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,MAAM,uDAAuD,CAAC;QAC5D,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE;YACL,aAAa;YACb,iCAAiC,CAAC,KAAK,CAAC,oBAAoB,CAAC;SAC9D;QACD,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kCAAkC,CAAC,KAI3C;IACC,MAAM,mBAAmB,GACvB,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,CAAC;IACrD,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;IAC9E,+EAA+E;IAC/E,+CAA+C;IAC/C,IACE,CAAC,mBAAmB;QACpB,CAAC,qBAAqB;QACtB,KAAK,CAAC,eAAe,CAAC,WAAW;YAC/B,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;QACtC,qBAAqB,KAAK,mBAAmB,EAC7C,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,8BAA8B,CACpD,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EACpC,KAAK,CAAC,eAAe,CACtB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,KAAmC;IAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAC,KAYhD;IAIC,IACE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;QACpC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAClE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,kBAAkB,GAAG,uCAAuC,CAAC;QACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACnC,CAAC,CAAC;IACH,IACE,kBAAkB,KAAK,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,kBAAkB;QAClE,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YAChC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,sBAAsB,GAAG,MAAM,gCAAgC,CAAC;QACpE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,IAAI;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,oCAAoC,CAAC;QACzC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,kCAAkC,CAAC;QACjC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY;YACtE,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;YAClE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;YACjD,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS;YAC7C,kBAAkB;YAClB,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc;YACvD,QAAQ;YACR,sBAAsB;YACtB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gDAAgD,CAC7D,KAAqC;IASrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAAC;QAC1D,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc;QACvD,OAAO,EAAE;YACP,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO;YACrC,gBAAgB,EAAE,oBAAoB,CAAC,IAAI,CAAC,OAAO;SACpD;QACD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,iCAAiC,CAAC;QACvC,eAAe;QACf,aAAa;QACb,OAAO;QACP,oBAAoB;QACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,KAIC;IAED,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,IAAI,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9C,MAAM,WAAW,GAAG;QAClB,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,IAAI,2BAA2B,EAAE;KACjD,CAAC;IACF,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,MAAM,gDAAgD,CAAC;YACvE,GAAG,KAAK;YACR,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,KAAK,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;YAChD,SAAS;YACT,OAAO,EAAE,SAAS;YAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,gBAAgB;YAChB,KAAK,EAAE,WAAW;YAClB,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;YACD,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,2BAA2B,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC;YAC/D,WAAW;YACX,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAAC,KAQ/D;IACC,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IAC7E,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,yFAAyF,CAC1F,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,gBAAgB;QACtB,CAAC,MAAM,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,sCAAsC,CAAC;QAC5C,MAAM;QACN,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,gBAAgB;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,gBAAgB;QAChB,eAAe;QACf,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerAccessManifestState } from \"@tearleads/crypto\";\nimport {\n  type ContainerSystemSlot,\n  isContainerSystemSlot,\n} from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerCreateWithMetadataDocumentRequest } from \"@tearleads/validators/request\";\nimport type {\n  ContainerCreateWithMetadataDocumentResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { locallyAcknowledgedContainerMutationHead } from \"../../../../data/containers/shared/mutationAcknowledgement\";\nimport type { ContainerMutationSubmitFailure } from \"../../../../data/containers/shared/types\";\nimport { assertDocumentWriterProjectionConsistent } from \"../../../../data/documents/shared/projection\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport {\n  advanceLocallyAcknowledgedAccessManifestHeadsAtomically,\n  locallyAuthoredAccessManifestHead,\n} from \"../../../../data/persistence/locallyAcknowledgedCheckpointPersistence\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport {\n  type buildMaterializedContainerCreatePlan,\n  readContainerMutationMetadataDocumentId,\n} from \"../../../containers\";\nimport { repairContainerCreateFailure } from \"../../../containers/child/create/createSubmission\";\nimport {\n  type buildMaterializedDocumentCreatePlan,\n  documentWriterProjectionFromCreateResponse,\n  persistedDocumentCreateStateFromResponse,\n  resolveDocumentCreateAuthor,\n} from \"../../../documents\";\nimport { PrincipalPolicyRepairBudget } from \"../../../principals/policyRepairBudget\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n} from \"../types\";\nimport { settleTerminalCreateFailure } from \"./createTerminalFailure\";\nimport {\n  buildContainerWithMetadataPlans,\n  type ContainerWithMetadataPlanInput,\n} from \"./createWithMetadataPlan\";\n\n/**\n * Sentinel for a lost-response retry whose manifest already exists remotely.\n * Callers avoid a duplicate; the next parent hydration settles local state.\n */\nexport const CONTAINER_ALREADY_COMMITTED = Symbol(\"containerAlreadyCommitted\");\nexport type ContainerAlreadyCommitted = typeof CONTAINER_ALREADY_COMMITTED;\n\nasync function submitContainerWithMetadataDocument(input: {\n  readonly organizationId: string;\n  readonly request: ContainerCreateWithMetadataDocumentRequest;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | {\n      readonly ok: true;\n      readonly response: ContainerCreateWithMetadataDocumentResponse;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const { apiClient } = input.runtime;\n  const result = await apiClient.createContainerWithMetadataDocumentResult(\n    input.request,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n    },\n  );\n  return result.ok ? { ok: true, response: result.data } : result;\n}\n\n/**\n * Seed the metadata document's writer projection from the create response so the\n * first read after the container is created (its own metadata sync, contents\n * hydration) resolves locally instead of a cold `GET writer-projection`. The\n * authorizing path is the child container projection the create was authored\n * against — locally built rather than server-fetched, so unlike the plain\n * document-create path this is gated on the projection's internal consistency;\n * on any mismatch the seed is skipped and the next read falls back to a fetch.\n */\nasync function seedMetadataDocumentWriterProjection(input: {\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly execSql?: ExecSql | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<void> {\n  const projection = documentWriterProjectionFromCreateResponse({\n    containerProjection: input.childProjection,\n    response: input.response.metadataDocument,\n  });\n  try {\n    await assertDocumentWriterProjectionConsistent(projection, {\n      execSql: input.execSql,\n      stillCurrent: input.stillCurrent,\n      trustedLocalProjection: true,\n    });\n  } catch {\n    return;\n  }\n  if (input.stillCurrent?.() === false) return;\n  input.runtime.apiClient.primeDocumentWriterProjection(\n    input.response.metadataDocument.id,\n    projection,\n  );\n}\n\nasync function acknowledgeContainerWithMetadata(input: {\n  containerPlan: Parameters<\n    typeof locallyAcknowledgedContainerMutationHead\n  >[0][\"plan\"];\n  execSql: ExecSql;\n  metadataDocumentPlan: Parameters<\n    typeof persistedDocumentCreateStateFromResponse\n  >[0];\n  response: ContainerCreateWithMetadataDocumentResponse;\n  stillCurrent?: (() => boolean) | undefined;\n}) {\n  const persistedState = persistedDocumentCreateStateFromResponse(\n    input.metadataDocumentPlan,\n    input.response.metadataDocument,\n  );\n  const containerHead = await locallyAcknowledgedContainerMutationHead({\n    plan: input.containerPlan,\n    response: input.response.container,\n  });\n  await advanceLocallyAcknowledgedAccessManifestHeadsAtomically({\n    execSql: input.execSql,\n    heads: [\n      containerHead,\n      locallyAuthoredAccessManifestHead(input.metadataDocumentPlan),\n    ],\n    stillCurrent: input.stillCurrent,\n  });\n  return persistedState;\n}\n\n/**\n * Prime the new container's writer projection from the create plan the client\n * just authored, so the first write under it (a child folder, a document)\n * resolves locally instead of a cold `GET writer-projection`. Only primed when\n * the locally-built projection matches what the server created — the create\n * response echoes the container id and manifest head — so a mismatch skips the\n * seed and the next write falls back to a fetch (same fail-closed contract as\n * the metadata-document seed). Priming is safe for writes: the server still\n * validates every mutation, so a projection that later goes stale (rekey/share/\n * move evict it) just yields a rejected write that retries with a fresh fetch.\n */\nfunction seedChildContainerWriterProjection(input: {\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly runtime: ContainerWorkflowRuntime;\n}): void {\n  const createdManifestHash =\n    input.response.container.manifestHead.manifestHash;\n  const projectedManifestHash = input.childProjection.path.at(-1)?.manifestHash;\n  // Both hashes must be present and equal, or two undefined hashes would compare\n  // equal and prime an empty/invalid projection.\n  if (\n    !createdManifestHash ||\n    !projectedManifestHash ||\n    input.childProjection.containerId !==\n      input.response.container.containerId ||\n    projectedManifestHash !== createdManifestHash\n  ) {\n    return;\n  }\n\n  input.runtime.apiClient.primeContainerWriterProjection(\n    input.response.container.containerId,\n    input.childProjection,\n  );\n}\n\n/**\n * The persisted slot is the one this client signed into the manifest state.\n * The acknowledgement already refused a response that echoed anything else,\n * so the server's column never chooses which local record becomes Trash.\n */\nfunction signedCreateSystemSlot(\n  state: ContainerAccessManifestState,\n): ContainerSystemSlot | null {\n  if (state.systemSlot === null) return null;\n  if (!isContainerSystemSlot(state.systemSlot)) {\n    throw new Error(\"Container create plan signed an invalid system slot\");\n  }\n  return state.systemSlot;\n}\n\nasync function settleContainerWithMetadataCreate(input: {\n  readonly childProjection: ContainerWriterProjectionResponse;\n  readonly containerPlan: Awaited<\n    ReturnType<typeof buildMaterializedContainerCreatePlan>\n  >;\n  readonly execSql: ExecSql;\n  readonly metadataDocumentPlan: Awaited<\n    ReturnType<typeof buildMaterializedDocumentCreatePlan>\n  >;\n  readonly response: ContainerCreateWithMetadataDocumentResponse;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<{\n  readonly ok: true;\n  readonly state: CreatedRemoteContainerState;\n} | null> {\n  if (\n    input.response.container.containerId !==\n    input.containerPlan.plan.containerId\n  ) {\n    throw new Error(\"Container metadata create response container mismatch\");\n  }\n  // The acknowledgement echoed the signed parent, which a child always names.\n  const parentId = input.containerPlan.plan.state.parentContainerId;\n  if (parentId === null) {\n    throw new Error(\"A container create must commit under a parent\");\n  }\n  const metadataDocumentId = readContainerMutationMetadataDocumentId({\n    response: input.response.container,\n  });\n  if (\n    metadataDocumentId !== input.containerPlan.plan.metadataDocumentId ||\n    input.response.metadataDocument.id !==\n      input.metadataDocumentPlan.plan.documentId\n  ) {\n    throw new Error(\"Container metadata create response document mismatch\");\n  }\n  const persistedMetadataState = await acknowledgeContainerWithMetadata({\n    containerPlan: input.containerPlan.plan,\n    execSql: input.execSql,\n    metadataDocumentPlan: input.metadataDocumentPlan.plan,\n    response: input.response,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  await seedMetadataDocumentWriterProjection({\n    childProjection: input.childProjection,\n    execSql: input.execSql,\n    response: input.response,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n  if (input.stillCurrent?.() === false) return null;\n  seedChildContainerWriterProjection({\n    childProjection: input.childProjection,\n    response: input.response,\n    runtime: input.runtime,\n  });\n  return {\n    ok: true,\n    state: {\n      accessManifestHash: input.response.container.manifestHead.manifestHash,\n      systemSlot: signedCreateSystemSlot(input.containerPlan.plan.state),\n      containerId: input.response.container.containerId,\n      createdAt: input.response.container.createdAt,\n      metadataDocumentId,\n      organizationId: input.response.container.organizationId,\n      parentId,\n      persistedMetadataState,\n      updatedAt: input.response.container.updatedAt,\n    },\n  };\n}\n\nasync function createRemoteContainerWithMetadataDocumentAttempt(\n  input: ContainerWithMetadataPlanInput,\n): Promise<\n  | {\n      readonly ok: true;\n      readonly state: CreatedRemoteContainerState;\n    }\n  | ContainerMutationSubmitFailure\n  | null\n> {\n  const execSql = input.runtime.infra.execSql;\n  const plans = await buildContainerWithMetadataPlans(input);\n  if (!plans) return null;\n  const { containerPlan, childProjection, metadataDocumentPlan } = plans;\n  const submitted = await submitContainerWithMetadataDocument({\n    organizationId: containerPlan.plan.state.organizationId,\n    request: {\n      systemSlot: input.systemSlot ?? null,\n      container: containerPlan.plan.request,\n      metadataDocument: metadataDocumentPlan.plan.request,\n    },\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n  if (!submitted?.ok) {\n    return submitted;\n  }\n  return settleContainerWithMetadataCreate({\n    childProjection,\n    containerPlan,\n    execSql,\n    metadataDocumentPlan,\n    response: submitted.response,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n}\n\nasync function createContainerWithMetadataWithRepairs(\n  input: Parameters<\n    typeof createRemoteContainerWithMetadataDocumentAttempt\n  >[0] & {\n    readonly parentContainerId: string;\n  },\n): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  const { apiClient } = input.runtime;\n  let parentProjection = input.parentProjection;\n  const repairState = {\n    didRepairStaleParent: false,\n    policyRepairs: new PrincipalPolicyRepairBudget(),\n  };\n  for (;;) {\n    const submitted = await createRemoteContainerWithMetadataDocumentAttempt({\n      ...input,\n      parentProjection,\n    });\n    if (!submitted) {\n      return null;\n    }\n    if (submitted.ok) {\n      return submitted.state;\n    }\n    const repair = await repairContainerCreateFailure({\n      apiClient,\n      failure: submitted,\n      parentContainerId: input.parentContainerId,\n      parentProjection,\n      state: repairState,\n      warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n        input.runtime,\n      ),\n      stillCurrent: input.stillCurrent,\n    });\n    if (repair.kind === \"retry\") {\n      parentProjection = repair.parentProjection;\n      continue;\n    }\n    if (repair.kind === \"unavailable\") return null;\n    return settleTerminalCreateFailure(submitted, input.stillCurrent) ===\n      \"committed\"\n      ? CONTAINER_ALREADY_COMMITTED\n      : null;\n  }\n}\n\nexport async function createRemoteContainerWithMetadataDocument(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  const author = resolveDocumentCreateAuthor(input.runtime);\n  const { apiClient } = input.runtime;\n  const parentSecretKey = input.runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !parentSecretKey) {\n    input.runtime.util.log(\n      \"Container contents: skipped container create because the writer context is unavailable.\",\n    );\n    return null;\n  }\n\n  const parentProjection =\n    input.parentProjection ??\n    (await apiClient.getContainerWriterProjection(input.parentContainerId));\n  if (!parentProjection) {\n    return null;\n  }\n\n  const containerEventId = crypto.randomUUID();\n  const containerKey = crypto.getRandomValues(new Uint8Array(32));\n  const containerSignedAt = new Date().toISOString();\n  const metadataContentKey = crypto.getRandomValues(new Uint8Array(32));\n  const metadataEventId = crypto.randomUUID();\n  const metadataSignedAt = new Date().toISOString();\n  return createContainerWithMetadataWithRepairs({\n    author,\n    containerEventId,\n    containerId: input.containerId,\n    containerKey,\n    containerSignedAt,\n    metadataContentKey,\n    metadataEventId,\n    metadataSignedAt,\n    parentContainerId: input.parentContainerId,\n    parentProjection,\n    parentSecretKey,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    systemSlot: input.systemSlot,\n  });\n}\n"]}

package/workflows/container-contents/container-state/{createWithMetadataPlan.js → create/createWithMetadataPlan.js}

@@ -1,7 +1,7 @@
-import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../../containers/index.js";
-import { buildMaterializedDocumentCreatePlan, } from "../../documents/index.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { buildMaterializedContainerCreatePlan, childContainerWriterProjectionFromCreatePlan, } from "../../../containers/index.js";
+import { buildMaterializedDocumentCreatePlan, } from "../../../documents/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
 async function buildPlans(input) {
     const execSql = input.runtime.infra.execSql;
     // Rebuild parent- and policy-dependent hashes, signatures, and wraps on every

package/workflows/container-contents/container-state/create/createWithMetadataPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createWithMetadataPlan.js","sourceRoot":"","sources":["createWithMetadataPlan.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EACL,oCAAoC,EACpC,4CAA4C,GAC7C,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mCAAmC,GAEpC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAoB7F,KAAK,UAAU,UAAU,CAAC,KAAqC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,aAAa,GAAG,MAAM,oCAAoC,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,gBAAgB;QAC/B,kBAAkB,EAAE,KAAK,CAAC,WAAW;QACrC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,QAAQ,EAAE,KAAK,CAAC,iBAAiB;QACjC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,4CAA4C,CAAC;QACnE,gBAAgB,EAAE,aAAa;QAC/B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,eAAe;QACpC,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,UAAU,EAAE,aAAa,CAAC,IAAI,CAAC,kBAAkB;QACjD,OAAO,EAAE,KAAK,CAAC,eAAe;QAC9B,OAAO;QACP,kBAAkB,EAAE,IAAI,GAAG,CAAC;YAC1B,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC;SACrE,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,gBAAgB;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,sBAAsB,EAAE,IAAI;KAC7B,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAClE,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAqC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,oCAAoC,CAAC;YAAE,MAAM,KAAK,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACpD,SAAS,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,gBAAgB,GACpB,MAAM,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvE,IACE,gBAAgB,CAAC,WAAW,KAAK,QAAQ;QACzC,gBAAgB,CAAC,cAAc,KAAK,KAAK,CAAC,gBAAgB,CAAC,cAAc,EACzE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  buildMaterializedContainerCreatePlan,\n  childContainerWriterProjectionFromCreatePlan,\n} from \"../../../containers\";\nimport {\n  buildMaterializedDocumentCreatePlan,\n  type resolveDocumentCreateAuthor,\n} from \"../../../documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerWorkflowRuntime } from \"../types\";\n\nexport interface ContainerWithMetadataPlanInput {\n  readonly author: NonNullable<ReturnType<typeof resolveDocumentCreateAuthor>>;\n  readonly containerEventId: string;\n  readonly containerId: string;\n  readonly containerKey: Uint8Array;\n  readonly containerSignedAt: string;\n  readonly metadataContentKey: Uint8Array;\n  readonly metadataEventId: string;\n  readonly metadataSignedAt: string;\n  readonly parentProjection: ContainerWriterProjectionResponse;\n  readonly parentSecretKey: Uint8Array;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly runtime: ContainerWorkflowRuntime;\n  readonly systemSlot?: ContainerSystemSlot | null | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function buildPlans(input: ContainerWithMetadataPlanInput) {\n  const execSql = input.runtime.infra.execSql;\n  // Rebuild parent- and policy-dependent hashes, signatures, and wraps on every\n  // attempt while retaining the logical mutation identities and key material.\n  const containerPlan = await buildMaterializedContainerCreatePlan({\n    author: input.author,\n    containerId: input.containerId,\n    containerKey: input.containerKey,\n    execSql,\n    eventId: input.containerEventId,\n    metadataDocumentId: input.containerId,\n    systemSlot: input.systemSlot,\n    parentProjection: input.parentProjection,\n    parentSecretKey: input.parentSecretKey,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    signedAt: input.containerSignedAt,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  const childProjection = childContainerWriterProjectionFromCreatePlan({\n    materializedPlan: containerPlan,\n    parentProjection: input.parentProjection,\n  });\n  const metadataDocumentPlan = await buildMaterializedDocumentCreatePlan({\n    author: input.author,\n    containerProjection: childProjection,\n    contentKey: input.metadataContentKey,\n    documentId: containerPlan.plan.metadataDocumentId,\n    eventId: input.metadataEventId,\n    execSql,\n    knownContainerKeks: new Map([\n      [containerPlan.plan.containerKeyEpochId, containerPlan.containerKey],\n    ]),\n    signedAt: input.metadataSignedAt,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey: input.parentSecretKey,\n    trustedLocalProjection: true,\n  });\n  return { containerPlan, childProjection, metadataDocumentPlan };\n}\n\n/** Refresh stale history evidence once, strictly before submitting the write. */\nexport async function buildContainerWithMetadataPlans(\n  input: ContainerWithMetadataPlanInput,\n) {\n  try {\n    return await buildPlans(input);\n  } catch (error) {\n    if (!(error instanceof ProjectionDependencyUnavailableError)) throw error;\n  }\n  if (input.stillCurrent?.() === false) return null;\n  const { apiClient } = input.runtime;\n  const parentId = input.parentProjection.containerId;\n  apiClient.evictContainerWriterProjection(parentId);\n  const parentProjection =\n    await apiClient.getContainerWriterProjection(parentId);\n  if (!parentProjection || input.stillCurrent?.() === false) return null;\n  if (\n    parentProjection.containerId !== parentId ||\n    parentProjection.organizationId !== input.parentProjection.organizationId\n  ) {\n    throw new Error(\n      \"Refreshed parent projection belongs to another container or organization\",\n    );\n  }\n  return buildPlans({ ...input, parentProjection });\n}\n"]}

package/workflows/container-contents/container-state/{localPurgeScope.js → purge/localPurgeScope.js}

@@ -1,4 +1,4 @@
-import { hasUnsettledDocumentPlacement } from "../../../data/persistence/container-contents/documentPurgePlacement.js";
+import { hasUnsettledDocumentPlacement } from "../../../../data/persistence/container-contents/documentPurgePlacement.js";
 function guardedContainerIds(input) {
     const guardedIds = new Set();
     const seen = new Set();

package/workflows/container-contents/container-state/purge/localPurgeScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localPurgeScope.js","sourceRoot":"","sources":["localPurgeScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AAgBvH,SAAS,mBAAmB,CAAC,KAA2B;IACtD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;IAClC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,YAAY,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;YAC/D,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,MAAM,YAAY,EAAE,CAAC;QACpC,IAAI,SAAS,KAAK,KAAK,CAAC,eAAe;YAAE,MAAM;QAC/C,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;IAC1C,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA2B;IAE3B,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,MAAM,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnE,MAAM,YAAY,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,0EAA0E;IAC1E,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAChE,KAAK,CAAC,OAAO,EACb,EAAE,CACH,CAAC;QACF,IACE,CAAC,OAAO,EAAE,MAAM;YAChB,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;YAC1D,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,cAAc;YACtE,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;YAExD,MAAM,YAAY,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7D,KAAK,CAAC,OAAO,CACd,CAAC;IACF,IACE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5D,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAEhC,MAAM,YAAY,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,KAAK,CACd,6DAA6D,CAC9D,CAAC;AACJ,CAAC","sourcesContent":["import { hasUnsettledDocumentPlacement } from \"../../../../data/persistence/container-contents/documentPurgePlacement\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport type { ContainerState } from \"../../remoteHydration\";\n\ninterface LocalPurgeScopeInput {\n  containerId: string | null | undefined;\n  containersById: ReadonlyMap<string, ContainerState>;\n  execSql: ExecSql;\n  localId?: string | undefined;\n  persistence: ContainerContentsPersistence;\n  rootContainerId: string;\n  stillCurrent?: (() => boolean) | undefined;\n  verifiedAncestorsById: ReadonlyMap<string, readonly string[]>;\n}\n\nfunction guardedContainerIds(input: LocalPurgeScopeInput): ReadonlySet<string> {\n  const guardedIds = new Set<string>();\n  const seen = new Set<string>();\n  let currentId = input.containerId;\n  while (true) {\n    if (!currentId || seen.has(currentId)) throw changedScope();\n    seen.add(currentId);\n    guardedIds.add(currentId);\n    for (const id of input.verifiedAncestorsById.get(currentId) ?? [])\n      guardedIds.add(id);\n    const expected = input.containersById.get(currentId);\n    if (!expected) throw changedScope();\n    if (currentId === input.rootContainerId) break;\n    currentId = expected.container.parentId;\n  }\n  return guardedIds;\n}\n\n/** Called inside the document deletion transaction; performs no remote I/O. */\nexport async function assertLocalPurgeScope(\n  input: LocalPurgeScopeInput,\n): Promise<void> {\n  if (\n    input.localId !== undefined &&\n    (await hasUnsettledDocumentPlacement(input.execSql, input.localId))\n  )\n    throw changedScope();\n  const guardedIds = guardedContainerIds(input);\n  // Include every known signed ancestor as well as the local selection chain.\n  // A dishonest listing can give these chains different intermediate nodes.\n  for (const id of guardedIds) {\n    const expected = input.containersById.get(id);\n    if (!expected) continue;\n    const current = await input.persistence.loadContainerMetadataState(\n      input.execSql,\n      id,\n    );\n    if (\n      !current?.record ||\n      current.container.parentId !== expected.container.parentId ||\n      current.container.organizationId !== expected.container.organizationId ||\n      current.record.documentId !== expected.record.documentId\n    )\n      throw changedScope();\n  }\n  const pending = await input.persistence.listUnsyncedMoveIntents(\n    input.execSql,\n  );\n  if (\n    pending.some((intent) => guardedIds.has(intent.containerId)) ||\n    input.stillCurrent?.() === false\n  )\n    throw changedScope();\n}\n\nfunction changedScope(): Error {\n  return new Error(\n    \"Local subtree purge scope changed before deletion committed\",\n  );\n}\n"]}

package/workflows/container-contents/container-state/{purgeTree.js → purge/purgeTree.js}

@@ -1,8 +1,8 @@
-import { DEFAULT_DOCUMENT_KIND } from "../../../data/documents/documentConstants.js";
-import { sqlDocumentContainerProjectionPersistence } from "../../../data/persistence/containers/documentContainerProjectionPersistence.js";
-import { listDocumentsByContainerIdsOrDocumentIds } from "../../../data/persistence/documents/documentsPersistence.js";
-import { unlinkRemoteContainerDocument } from "../documentLinks/index.js";
-import { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "../tombstones/documentPurge.js";
+import { DEFAULT_DOCUMENT_KIND } from "../../../../data/documents/documentConstants.js";
+import { sqlDocumentContainerProjectionPersistence } from "../../../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { listDocumentsByContainerIdsOrDocumentIds } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { unlinkRemoteContainerDocument } from "../../documentLinks/index.js";
+import { purgeLocalContainerDocument, purgeRemoteContainerDocument, } from "../../tombstones/documentPurge.js";
 import { collectSubtreeLeafFirst, snapshotContainerStates, } from "./purgeTreeCollection.js";
 import { deleteSubtreeContainers } from "./purgeTreeContainerDeletion.js";
 import { createSubtreePurgeScope } from "./purgeTreeScope.js";

package/workflows/container-contents/container-state/purge/purgeTree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTree.js","sourceRoot":"","sources":["purgeTree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAGrF,OAAO,EAAE,yCAAyC,EAAE,MAAM,gFAAgF,CAAC;AAC3I,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AAGvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AA4DhE,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CAAC,KAKvC;IACC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CACnD,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC7D,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CACnC,IAAI,GAAG,CACL,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC9C,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3C,CACF,CACF,CAAC;QACF,MAAM,mBAAmB,GACvB,KAAK,CAAC,oBAAoB;YAC1B,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,OAAO;YACb,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,CAC3C,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,mBAAmB,CACrD;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5D,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAGnC;IACC,MAAM,SAAS,GAAG,MAAM,wCAAwC,CAC9D,KAAK,CAAC,OAAO,EACb;QACE,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC5C,WAAW,EAAE,EAAE;KAChB,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvD,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IACF,MAAM,8BAA8B,GAClC,MAAM,yCAAyC,CAAC,mCAAmC,CACjF,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IAEJ,MAAM,KAAK,GAGN,EAAE,CAAC;IACR,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAG7B,CAAC;IACJ,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,uBAAuB,CAAC;YAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;YACvC,kBAAkB,EAAE,QAAQ,CAAC,UAAU;gBACrC,CAAC,CAAC,CAAC,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACjE,CAAC,CAAC,EAAE;YACN,oBAAoB,EAAE,QAAQ,CAAC,WAAW;YAC1C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ;gBACR,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC/B,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE;gBACxC,QAAQ;gBACR,YAAY,EAAE,WAAW,CAAC,YAAY;aACvC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAUpC;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAmC,CAAC;IACxC,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,KAAK,CAAC,+BAA+B,CAC5D,KAAK,CAAC,QAAQ,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;YACjD,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;YACnD,UAAU;YACV,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,SAAS,EAAE,KAAK,CAAC,YAAY;YAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YACzB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,iBAAiB,EAAE,WAAW;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,SAAS,gCAAgC,CACvC,KAA8B,EAC9B,KAAiD;IAEjD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAA8B,KAAK,CAAC,kBAAkB,IAAI;QACxE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC7B,CAAC,MAAM,2BAA2B,CAAC;YACjC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,KAAK,CAAC,6BAA6B,CACjC,OAAO,EACP,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,EAAE,CACZ;YACH,MAAM,EAAE,QAAQ,CAAC,EAAE;YACnB,mBAAmB,EAAE,QAAQ,CAAC,WAAW;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC,KAAK,IAAI;QACd,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC9B,OAAO,CACL,QAAQ,CAAC,UAAU;YACjB,CAAC,MAAM,4BAA4B,CAAC;gBAClC,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAClD,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,mBAAmB;gBACnB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,qBAAqB;gBAC5D,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;gBACxD,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC,CACN;QACH,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,CACjC,qBAAqB,CAAC;YACpB,iEAAiE;YACjE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAClC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACtC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAC5C,YAAY;YACZ,QAAQ;YACR,mBAAmB;YACnB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;YACtE,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC;KACL,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC7B,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC9B,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChE,CAAC;YACD,OAAO,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC;AAMD,2EAA2E;AAC3E,4EAA4E;AAC5E,SAAS,mBAAmB,CAC1B,KAA0E;IAE1E,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,eAAe;QACzB,QAAQ,EACN,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ;YACnE,IAAI;KACP,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAG1B;IACC,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,qEAAqE;AACrE,KAAK,UAAU,wBAAwB,CAAC,KAMvC;IACC,KAAK,MAAM,EACT,QAAQ,EACR,YAAY,GACb,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CACpD,QAAQ,EACR,YAAY,CACb,CAAC;QACF,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChE,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,IACE,kBAAkB,CAAC,MAAM,GAAG,CAAC;YAC7B,CAAC,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,EACtE,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,4EAA4E;AAC5E,qCAAqC;AACrC,EAAE;AACF,uEAAuE;AACvE,iFAAiF;AACjF,iFAAiF;AACjF,4EAA4E;AAC5E,6EAA6E;AAC7E,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgC;IAEhC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChE,CAAC;IACF,MAAM,aAAa,GAAG,uBAAuB,CAC3C,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,eAAe,CACtB,CAAC;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,aAAa,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CACnE,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,mBAAmB;KACpB,CAAC,CAAC;IACH,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,6BAA6B;IAC7B,MAAM,uBAAuB,GAAG,KAAK,CAAC,iBAAiB;QACrD,CAAC,CAAC,aAAa,CAAC,MAAM,CAClB,CAAC,cAAc,EAAE,EAAE,CACjB,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,eAAe,CACxD;QACH,CAAC,CAAC,aAAa,CAAC;IAElB,gFAAgF;IAChF,+EAA+E;IAC/E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,UAAU,GACd,IAAI,CAAC,gBAAgB,CAAC,IAAI;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC,UAAU,CAAC,MAAM;QACtB,uBAAuB,CAAC,MAAM,CAAC;IAEjC,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,EAAW,EAAE,EAAE;QACjC,IAAI,EAAE,EAAE,CAAC;YACP,cAAc,IAAI,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC;IACF,gFAAgF;IAChF,wCAAwC;IACxC,YAAY,EAAE,CAAC;IAEf,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC;QAC9C,kBAAkB,EAAE,gCAAgC,CAAC,KAAK,EAAE,KAAK,CAAC;QAClE,IAAI;QACJ,UAAU;QACV,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,kBAAkB,GAAsB,EAAE,CAAC;IAC/C,IAAI,yBAAyB,GAAsB,EAAE,CAAC;IACtD,IAAI,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC;YAC7C,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,6BAA6B,EAAE,KAAK,CAAC,6BAA6B;YAClE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU;YACV,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,uBAAuB;SACvC,CAAC,CAAC;QACH,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;QACjD,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;QAC/D,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IAC7B,CAAC;IAED,OAAO;QACL,OAAO;QACP,cAAc;QACd,WAAW;QACX,kBAAkB;QAClB,yBAAyB;QACzB,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_KIND } from \"../../../../data/documents/documentConstants\";\nimport type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { listDocumentsByContainerIdsOrDocumentIds } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport type { SubtreePurgeRoot } from \"../../../documents/purge/subtreePurgeScope\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport { unlinkRemoteContainerDocument } from \"../../documentLinks\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport {\n  purgeLocalContainerDocument,\n  purgeRemoteContainerDocument,\n} from \"../../tombstones/documentPurge\";\nimport type { PurgeProgress } from \"./purgeProgress\";\nimport {\n  collectSubtreeLeafFirst,\n  snapshotContainerStates,\n} from \"./purgeTreeCollection\";\nimport { deleteSubtreeContainers } from \"./purgeTreeContainerDeletion\";\nimport { createSubtreePurgeScope } from \"./purgeTreeScope\";\n\nexport { collectSubtreeLeafFirst } from \"./purgeTreeCollection\";\n\n// The store runtime satisfies the per-document purge/unlink workflows, so the\n// cascade reuses it verbatim.\ntype PurgeContainerTreeRuntime = ContainerContentsWorkflowRuntime;\n\ninterface PurgeContainerTreeInput {\n  readonly containersById: ReadonlyMap<string, ContainerState>;\n  readonly documentOperations?: SubtreeDocumentOperations | undefined;\n  // When true, tear down everything UNDER the root (its documents plus every\n  // descendant container) but never delete the root container itself. This is\n  // how \"Empty Trash\" reuses the same engine: the Trash bin is a protected system\n  // container that must survive while its whole contents are destroyed.\n  readonly keepRootContainer?: boolean;\n  readonly onProgress?: ((progress: PurgeProgress) => void) | undefined;\n  readonly persistence: ContainerContentsPersistence;\n  readonly prepareDocumentRotationSnapshot: (\n    document: DocumentSummary,\n  ) => Promise<Uint8Array | null>;\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly rootContainerId: string;\n  readonly runtime: PurgeContainerTreeRuntime;\n  /** Stops a stale store generation between complete destructive units. */\n  readonly stillCurrent?: (() => boolean) | undefined;\n  // Checked at each unit boundary (between whole documents / whole containers),\n  // never mid-remote-call, so a cancelled run stops on a consistent prefix.\n  readonly signal?: AbortSignal | undefined;\n}\n\ninterface PurgeContainerTreeResult {\n  readonly aborted: boolean;\n  readonly completedCount: number;\n  readonly failedCount: number;\n  readonly purgedContainerIds: readonly string[];\n  readonly remoteDeletedContainerIds: readonly string[];\n  readonly totalCount: number;\n}\n\ninterface SubtreeDocumentPlan {\n  // Synced documents whose every link falls inside the subtree: reduce them to\n  // one retained link, as required by the purge endpoint, then destroy them.\n  readonly purge: readonly {\n    document: DocumentSummary;\n    unlinkContainerIds: readonly string[];\n  }[];\n  // Synced documents also linked outside the subtree: keep them, but unlink\n  // from each in-subtree container so the containers can be deleted.\n  readonly unlinkByDocument: ReadonlyMap<\n    string,\n    { document: DocumentSummary; containerIds: readonly string[] }\n  >;\n  // Never-synced documents (no remote id): destroy locally only.\n  readonly purgeLocal: readonly DocumentSummary[];\n}\n\ntype SubtreeDocumentDisposition =\n  | { kind: \"purge\"; unlinkContainerIds: readonly string[] }\n  | { kind: \"purge-local\" }\n  | { kind: \"unlink\"; containerIds: readonly string[] };\n\n// Destroy local-only documents locally. Destroy synced documents only when all\n// links are in the subtree; preserve documents with an external link. The purge\n// plan reduces owned documents to the server-required sole link first.\nexport function classifySubtreeDocument(input: {\n  readonly documentId: string | null;\n  readonly linkedContainerIds: readonly string[];\n  readonly preferredContainerId?: string | null | undefined;\n  readonly subtreeContainerIds: ReadonlySet<string>;\n}): SubtreeDocumentDisposition {\n  if (!input.documentId) {\n    return { kind: \"purge-local\" };\n  }\n  const hasExternalLink = input.linkedContainerIds.some(\n    (containerId) => !input.subtreeContainerIds.has(containerId),\n  );\n  if (!hasExternalLink) {\n    const linkedContainerIds = Array.from(\n      new Set(\n        input.linkedContainerIds.filter((containerId) =>\n          input.subtreeContainerIds.has(containerId),\n        ),\n      ),\n    );\n    const retainedContainerId =\n      input.preferredContainerId &&\n      linkedContainerIds.includes(input.preferredContainerId)\n        ? input.preferredContainerId\n        : linkedContainerIds[0];\n    return {\n      kind: \"purge\",\n      unlinkContainerIds: linkedContainerIds.filter(\n        (containerId) => containerId !== retainedContainerId,\n      ),\n    };\n  }\n  return {\n    kind: \"unlink\",\n    containerIds: input.linkedContainerIds.filter((containerId) =>\n      input.subtreeContainerIds.has(containerId),\n    ),\n  };\n}\n\nasync function planSubtreeDocuments(input: {\n  readonly execSql: PurgeContainerTreeRuntime[\"infra\"][\"execSql\"];\n  readonly subtreeContainerIds: ReadonlySet<string>;\n}): Promise<SubtreeDocumentPlan> {\n  const documents = await listDocumentsByContainerIdsOrDocumentIds(\n    input.execSql,\n    {\n      containerIds: [...input.subtreeContainerIds],\n      documentIds: [],\n    },\n  );\n  const remoteDocumentIds = documents.flatMap((document) =>\n    document.documentId ? [document.documentId] : [],\n  );\n  const linkedContainerIdsByDocumentId =\n    await sqlDocumentContainerProjectionPersistence.listLinkedContainerIdsByDocumentIds(\n      input.execSql,\n      remoteDocumentIds,\n    );\n\n  const purge: Array<{\n    document: DocumentSummary;\n    unlinkContainerIds: readonly string[];\n  }> = [];\n  const purgeLocal: DocumentSummary[] = [];\n  const unlinkByDocument = new Map<\n    string,\n    { document: DocumentSummary; containerIds: readonly string[] }\n  >();\n  for (const document of documents) {\n    const disposition = classifySubtreeDocument({\n      documentId: document.documentId ?? null,\n      linkedContainerIds: document.documentId\n        ? (linkedContainerIdsByDocumentId.get(document.documentId) ?? [])\n        : [],\n      preferredContainerId: document.containerId,\n      subtreeContainerIds: input.subtreeContainerIds,\n    });\n    if (disposition.kind === \"purge-local\") {\n      purgeLocal.push(document);\n    } else if (disposition.kind === \"purge\") {\n      purge.push({\n        document,\n        unlinkContainerIds: disposition.unlinkContainerIds,\n      });\n    } else if (document.documentId) {\n      unlinkByDocument.set(document.documentId, {\n        document,\n        containerIds: disposition.containerIds,\n      });\n    }\n  }\n\n  return { purge, purgeLocal, unlinkByDocument };\n}\n\nasync function unlinkSubtreeDocument(input: {\n  /** Rechecks the document and this exact unlink target before dispatch. */\n  readonly beforeSubmit: (targetContainerId: string) => Promise<boolean>;\n  readonly expectedSubtreeRoot: SubtreePurgeRoot;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly containerIds: readonly string[];\n  readonly document: DocumentSummary;\n  readonly prepareDocumentRotationSnapshot: PurgeContainerTreeInput[\"prepareDocumentRotationSnapshot\"];\n  readonly resolveProjectionUserKey: ProjectionUserKeyResolver;\n  readonly runtime: PurgeContainerTreeRuntime;\n}): Promise<boolean> {\n  const documentId = input.document.documentId;\n  if (!documentId) {\n    return true;\n  }\n  let rotationSnapshot: Uint8Array | null;\n  try {\n    rotationSnapshot = await input.prepareDocumentRotationSnapshot(\n      input.document,\n    );\n  } catch {\n    return false;\n  }\n  if (!rotationSnapshot) {\n    return false;\n  }\n  for (const containerId of input.containerIds) {\n    const result = await unlinkRemoteContainerDocument({\n      beforeSubmit: () => input.beforeSubmit(containerId),\n      documentId,\n      expectedSubtreeRoot: input.expectedSubtreeRoot,\n      isCurrent: input.stillCurrent,\n      noteId: input.document.id,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      rotationSnapshot,\n      runtime: input.runtime,\n      targetContainerId: containerId,\n    });\n    if (result === null) {\n      return false;\n    }\n  }\n  return true;\n}\n\ninterface SubtreeDocumentOperations {\n  readonly purgeLocal: (document: DocumentSummary) => Promise<boolean>;\n  readonly purgeRemote: (document: DocumentSummary) => Promise<boolean>;\n  readonly unlink: (\n    document: DocumentSummary,\n    containerIds: readonly string[],\n  ) => Promise<boolean>;\n}\n\nfunction resolveSubtreeDocumentOperations(\n  input: PurgeContainerTreeInput,\n  scope: ReturnType<typeof createSubtreePurgeScope>,\n): SubtreeDocumentOperations {\n  const expectedSubtreeRoot = selectedSubtreeRoot(input);\n  const operations: SubtreeDocumentOperations = input.documentOperations ?? {\n    purgeLocal: async (document) =>\n      (await purgeLocalContainerDocument({\n        beforeDeleteInTransaction: (execSql) =>\n          scope.assertLocalScopeInTransaction(\n            execSql,\n            document.containerId,\n            document.id,\n          ),\n        noteId: document.id,\n        expectedContainerId: document.containerId,\n        runtime: input.runtime,\n      })) !== null,\n    purgeRemote: async (document) =>\n      Boolean(\n        document.documentId &&\n          (await purgeRemoteContainerDocument({\n            beforeSubmit: () => scope.allowsDocument(document),\n            documentId: document.documentId,\n            expectedSubtreeRoot,\n            stillCurrent: input.stillCurrent,\n            documentKind: document.documentKind ?? DEFAULT_DOCUMENT_KIND,\n            noteId: document.id,\n            resolveProjectionUserKey: input.resolveProjectionUserKey,\n            runtime: input.runtime,\n          })),\n      ),\n    unlink: (document, containerIds) =>\n      unlinkSubtreeDocument({\n        // Target preparation and signing can outlast the upfront checks.\n        beforeSubmit: async (containerId) =>\n          (await scope.allowsDocument(document)) &&\n          (await scope.allowsContainer(containerId)),\n        containerIds,\n        document,\n        expectedSubtreeRoot,\n        stillCurrent: input.stillCurrent,\n        prepareDocumentRotationSnapshot: input.prepareDocumentRotationSnapshot,\n        resolveProjectionUserKey: input.resolveProjectionUserKey,\n        runtime: input.runtime,\n      }),\n  };\n  return {\n    purgeLocal: async (document) =>\n      (await scope.allowsDocument(document)) &&\n      (await operations.purgeLocal(document)),\n    purgeRemote: async (document) =>\n      (await scope.allowsDocument(document)) &&\n      (await operations.purgeRemote(document)),\n    unlink: async (document, containerIds) => {\n      if (!(await scope.allowsDocument(document))) return false;\n      for (const containerId of containerIds) {\n        if (!(await scope.allowsContainer(containerId))) return false;\n      }\n      return operations.unlink(document, containerIds);\n    },\n  };\n}\n\ninterface SubtreeTeardownResult {\n  readonly aborted: boolean;\n}\n\n// Signed request paths must keep the root under the parent it was selected\n// from; a settled restore elsewhere preserves the root's own documents too.\nfunction selectedSubtreeRoot(\n  input: Pick<PurgeContainerTreeInput, \"containersById\" | \"rootContainerId\">,\n): SubtreePurgeRoot {\n  return {\n    id: input.rootContainerId,\n    parentId:\n      input.containersById.get(input.rootContainerId)?.container.parentId ??\n      null,\n  };\n}\n\nfunction purgeWasCancelled(input: {\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): boolean {\n  return input.signal?.aborted === true || input.stillCurrent?.() === false;\n}\n\n// Tear down one whole document per progress step. A failed document is skipped,\n// leaving its container undeletable while the remaining subtree work continues.\n// Cancellation is honored only between complete document operations.\nasync function teardownSubtreeDocuments(input: {\n  readonly documentOperations: SubtreeDocumentOperations;\n  readonly plan: SubtreeDocumentPlan;\n  readonly reportStep: (ok: boolean) => void;\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n}): Promise<SubtreeTeardownResult> {\n  for (const {\n    document,\n    containerIds,\n  } of input.plan.unlinkByDocument.values()) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    const unlinked = await input.documentOperations.unlink(\n      document,\n      containerIds,\n    );\n    input.reportStep(unlinked);\n  }\n  for (const { document, unlinkContainerIds } of input.plan.purge) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    if (\n      unlinkContainerIds.length > 0 &&\n      !(await input.documentOperations.unlink(document, unlinkContainerIds))\n    ) {\n      input.reportStep(false);\n      continue;\n    }\n    input.reportStep(await input.documentOperations.purgeRemote(document));\n  }\n  for (const document of input.plan.purgeLocal) {\n    if (purgeWasCancelled(input)) {\n      return { aborted: true };\n    }\n    input.reportStep(await input.documentOperations.purgeLocal(document));\n  }\n  return { aborted: false };\n}\n\n// Permanently destroy a folder that lives inside Trash, including everything\n// under it (or, with keepRootContainer, everything under the Trash bin while\n// leaving the bin in place — this is \"Empty Trash\"). Documents are destroyed only\n// when the subtree holds their last link; multi-folder documents are unlinked\n// from the subtree and preserved. Containers are deleted leaf-first so each\n// delete obeys the leaf-only constraint the store and server enforce. Every step\n// is remote-first then local (the per-document and per-container workflows handle\n// that internally), so a cancel between steps leaves local state reflecting\n// exactly the completed remote work.\n//\n// Progress is determinate: the plan (a pure read) completes before any\n// destructive step, so onProgress reports completed/failed against a total known\n// up front. A failed item is skipped rather than aborting the run, so the result\n// reports whatever prefix was actually destroyed alongside completed/failed\n// counts and whether a cancellation cut it short. Returns null only when the\n// target container is absent from the snapshot.\nexport async function purgeContainerTree(\n  request: PurgeContainerTreeInput,\n): Promise<PurgeContainerTreeResult | null> {\n  if (purgeWasCancelled(request)) {\n    return null;\n  }\n  const input = {\n    ...request,\n    containersById: snapshotContainerStates(request.containersById),\n  };\n  const subtreeStates = collectSubtreeLeafFirst(\n    input.containersById,\n    input.rootContainerId,\n  );\n  if (subtreeStates.length === 0) {\n    return null;\n  }\n  const subtreeContainerIds = new Set(\n    subtreeStates.map((containerState) => containerState.container.id),\n  );\n\n  const plan = await planSubtreeDocuments({\n    execSql: input.runtime.infra.execSql,\n    subtreeContainerIds,\n  });\n  if (purgeWasCancelled(input)) {\n    return null;\n  }\n\n  // Empty Trash keeps the Trash bin itself: tear down everything it holds, but\n  // exclude the root from the container deletions (deleting a system container\n  // would be rejected anyway).\n  const containerStatesToDelete = input.keepRootContainer\n    ? subtreeStates.filter(\n        (containerState) =>\n          containerState.container.id !== input.rootContainerId,\n      )\n    : subtreeStates;\n\n  // The total is fully known here — planning is a pure read that completes before\n  // any destructive step. Unlink work is counted per document (not per container\n  // link) so completed can never exceed total even when a document has several\n  // in-subtree links.\n  const totalCount =\n    plan.unlinkByDocument.size +\n    plan.purge.length +\n    plan.purgeLocal.length +\n    containerStatesToDelete.length;\n\n  let completedCount = 0;\n  let failedCount = 0;\n  const emitProgress = () => {\n    input.onProgress?.({ completedCount, failedCount, totalCount });\n  };\n  const reportStep = (ok: boolean) => {\n    if (ok) {\n      completedCount += 1;\n    } else {\n      failedCount += 1;\n    }\n    emitProgress();\n  };\n  // Emit the initial 0/total so a determinate bar renders immediately, before the\n  // first (potentially slow) remote call.\n  emitProgress();\n\n  const scope = createSubtreePurgeScope(input);\n  const teardown = await teardownSubtreeDocuments({\n    documentOperations: resolveSubtreeDocumentOperations(input, scope),\n    plan,\n    reportStep,\n    signal: input.signal,\n    stillCurrent: input.stillCurrent,\n  });\n\n  let purgedContainerIds: readonly string[] = [];\n  let remoteDeletedContainerIds: readonly string[] = [];\n  let aborted = teardown.aborted;\n  if (!teardown.aborted) {\n    const deletion = await deleteSubtreeContainers({\n      allowsContainer: scope.allowsContainer,\n      allowsLocalScopeInTransaction: scope.allowsLocalScopeInTransaction,\n      root: selectedSubtreeRoot(input),\n      persistence: input.persistence,\n      reportStep,\n      runtime: input.runtime,\n      signal: input.signal,\n      stillCurrent: input.stillCurrent,\n      subtreeStates: containerStatesToDelete,\n    });\n    purgedContainerIds = deletion.purgedContainerIds;\n    remoteDeletedContainerIds = deletion.remoteDeletedContainerIds;\n    aborted = deletion.aborted;\n  }\n\n  return {\n    aborted,\n    completedCount,\n    failedCount,\n    purgedContainerIds,\n    remoteDeletedContainerIds,\n    totalCount,\n  };\n}\n"]}

package/workflows/container-contents/container-state/purge/purgeTreeCollection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTreeCollection.js","sourceRoot":"","sources":["purgeTreeCollection.ts"],"names":[],"mappings":"AAEA,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CACrC,MAA2C;IAE3C,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/B,EAAE;QACF;YACE,GAAG,KAAK;YACR,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE;YACjC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;SAC5B;KACF,CAAC,CACH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,cAAmD,EACnD,eAAuB;IAEvB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAC;IACvD,KAAK,MAAM,cAAc,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;QACnD,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3C,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IACpD,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,KAAK,GAAG,CAAC,eAAe,CAAC,CAAC;IAChC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QACxC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvD,IAAI,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;YAChE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import type { ContainerState } from \"../../remoteHydration\";\n\n/** Own the placement fields; live store updates cannot revise purge intent. */\nexport function snapshotContainerStates(\n  states: ReadonlyMap<string, ContainerState>,\n): ReadonlyMap<string, ContainerState> {\n  return new Map(\n    [...states].map(([id, state]) => [\n      id,\n      {\n        ...state,\n        container: { ...state.container },\n        record: { ...state.record },\n      },\n    ]),\n  );\n}\n\n// Collect the target and descendants leaf-first because container deletion is\n// leaf-only. The enqueued set guards self/cyclic parent chains.\nexport function collectSubtreeLeafFirst(\n  containersById: ReadonlyMap<string, ContainerState>,\n  rootContainerId: string,\n): ContainerState[] {\n  const childIdsByParentId = new Map<string, string[]>();\n  for (const containerState of containersById.values()) {\n    const parentId = containerState.container.parentId;\n    if (parentId === null) continue;\n    const siblings = childIdsByParentId.get(parentId) ?? [];\n    siblings.push(containerState.container.id);\n    childIdsByParentId.set(parentId, siblings);\n  }\n\n  const ordered: ContainerState[] = [];\n  const enqueued = new Set<string>([rootContainerId]);\n  // Read through the queue with a head index rather than shift(): shift() is\n  // O(N) per call, which would make the whole walk O(N^2).\n  const queue = [rootContainerId];\n  for (let head = 0; head < queue.length; head++) {\n    const containerId = queue[head];\n    if (containerId === undefined) continue;\n    const containerState = containersById.get(containerId);\n    if (containerState) ordered.push(containerState);\n    for (const childId of childIdsByParentId.get(containerId) ?? []) {\n      if (!enqueued.has(childId)) {\n        enqueued.add(childId);\n        queue.push(childId);\n      }\n    }\n  }\n\n  return ordered.reverse();\n}\n"]}

package/workflows/container-contents/container-state/{purgeTreeContainerDeletion.js → purge/purgeTreeContainerDeletion.js}

@@ -1,4 +1,4 @@
-import { deleteContainerState } from "./delete.js";
+import { deleteContainerState } from "../delete.js";
 // Descendants stay under the selected root. A root with a captured parent must
 // retain that ancestor; parentless roots have no parent constraint to send.
 function requiredDeletionAncestor(root, containerId) {

package/workflows/container-contents/container-state/purge/purgeTreeContainerDeletion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTreeContainerDeletion.js","sourceRoot":"","sources":["purgeTreeContainerDeletion.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAuBjD,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,wBAAwB,CAC/B,IAAsB,EACtB,WAAmB;IAEnB,OAAO,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmC;IAC/D,OAAO,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;AAC5E,CAAC;AAED,SAAS,8BAA8B,CAAC,KAKvC;IACC,IAAI,KAAK,CAAC,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACvC,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,yBAAyB,GAAa,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,cAAc,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;QACnD,IACE,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;YACjC,CAAC,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EAC3C,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,yBAAyB,EAAE,CAAC,OAAO,EAAE,EAAE,CACrC,KAAK,CAAC,6BAA6B,CAAC,OAAO,EAAE,WAAW,CAAC;YAC3D,cAAc;YACd,kBAAkB,EAAE,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC;YACrE,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;QACH,IACE,8BAA8B,CAAC;YAC7B,cAAc;YACd,OAAO;YACP,kBAAkB;YAClB,yBAAyB;SAC1B,CAAC,EACF,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,IACE,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,KAAK,gBAAgB,CAAC;gBAC9D,oBAAoB,CAAC,KAAK,CAAC,EAC3B,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,kBAAkB;oBAClB,yBAAyB;iBAC1B,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,CAAC;AAC3E,CAAC","sourcesContent":["import type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport type { SubtreePurgeRoot } from \"../../../documents/purge/subtreePurgeScope\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport { deleteContainerState } from \"../delete\";\n\ninterface SubtreeContainerDeletionResult {\n  readonly aborted: boolean;\n  readonly purgedContainerIds: string[];\n  readonly remoteDeletedContainerIds: string[];\n}\n\ninterface DeleteSubtreeContainersInput {\n  readonly allowsContainer: (containerId: string) => Promise<boolean>;\n  readonly allowsLocalScopeInTransaction: (\n    execSql: ExecSql,\n    containerId: string,\n  ) => Promise<boolean>;\n  readonly persistence: ContainerContentsPersistence;\n  readonly reportStep: (ok: boolean) => void;\n  readonly root: SubtreePurgeRoot;\n  readonly runtime: ContainerContentsWorkflowRuntime;\n  readonly signal?: AbortSignal | undefined;\n  readonly stillCurrent?: (() => boolean) | undefined;\n  readonly subtreeStates: readonly ContainerState[];\n}\n\n// Descendants stay under the selected root. A root with a captured parent must\n// retain that ancestor; parentless roots have no parent constraint to send.\nfunction requiredDeletionAncestor(\n  root: SubtreePurgeRoot,\n  containerId: string,\n): string {\n  return containerId === root.id ? (root.parentId ?? root.id) : root.id;\n}\n\nfunction deletionWasCancelled(input: DeleteSubtreeContainersInput): boolean {\n  return input.signal?.aborted === true || input.stillCurrent?.() === false;\n}\n\nfunction recordContainerDeletionOutcome(input: {\n  containerState: ContainerState;\n  deleted: Awaited<ReturnType<typeof deleteContainerState>>;\n  purgedContainerIds: string[];\n  remoteDeletedContainerIds: string[];\n}): boolean {\n  if (input.deleted === \"remote-deleted\") {\n    input.remoteDeletedContainerIds.push(input.containerState.container.id);\n  }\n  if (input.deleted !== \"deleted\") return false;\n  input.purgedContainerIds.push(input.containerState.container.id);\n  if (input.containerState.record.documentId) {\n    input.remoteDeletedContainerIds.push(input.containerState.container.id);\n  }\n  return true;\n}\n\n// Delete leaf-first. A surviving document or child blocks its container and all\n// ancestors; cancellation stops at a container boundary.\nexport async function deleteSubtreeContainers(\n  input: DeleteSubtreeContainersInput,\n): Promise<SubtreeContainerDeletionResult> {\n  const purgedContainerIds: string[] = [];\n  const remoteDeletedContainerIds: string[] = [];\n  const blockedParentIds = new Set<string>();\n  for (const containerState of input.subtreeStates) {\n    if (deletionWasCancelled(input)) {\n      return { aborted: true, purgedContainerIds, remoteDeletedContainerIds };\n    }\n    const containerId = containerState.container.id;\n    const parentId = containerState.container.parentId;\n    if (\n      blockedParentIds.has(containerId) ||\n      !(await input.allowsContainer(containerId))\n    ) {\n      if (parentId !== null) {\n        blockedParentIds.add(parentId);\n      }\n      input.reportStep(false);\n      continue;\n    }\n    const deleted = await deleteContainerState({\n      beforeDeleteInTransaction: (execSql) =>\n        input.allowsLocalScopeInTransaction(execSql, containerId),\n      containerState,\n      requiredAncestorId: requiredDeletionAncestor(input.root, containerId),\n      persistence: input.persistence,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n    });\n    if (\n      recordContainerDeletionOutcome({\n        containerState,\n        deleted,\n        purgedContainerIds,\n        remoteDeletedContainerIds,\n      })\n    ) {\n      input.reportStep(true);\n    } else {\n      if (\n        (deleted === \"local-conflict\" || deleted === \"remote-deleted\") &&\n        deletionWasCancelled(input)\n      ) {\n        return {\n          aborted: true,\n          purgedContainerIds,\n          remoteDeletedContainerIds,\n        };\n      }\n      if (parentId !== null) {\n        blockedParentIds.add(parentId);\n      }\n      input.reportStep(false);\n    }\n  }\n  return { aborted: false, purgedContainerIds, remoteDeletedContainerIds };\n}\n"]}

package/workflows/container-contents/container-state/{purgeTreeScope.js → purge/purgeTreeScope.js}

@@ -1,11 +1,11 @@
-import { KeyingVerificationError } from "../../../internal/crypto/index.js";
-import { verifyContainerWriterProjection } from "../../../data/keyingProjectionVerification/containerProjectionVerification.js";
-import { runWithSecurityIncidentReporting } from "../../../data/keyingProjectionVerification/error.js";
-import { rethrowProjectionVerificationCancelled } from "../../../data/keyingProjectionVerification/types.js";
-import { hasUnsettledDocumentPlacement } from "../../../data/persistence/container-contents/documentPurgePlacement.js";
-import { sqlDocumentsPersistence } from "../../../data/persistence/documents/documentsPersistence.js";
-import { errorMessage } from "../../../data/shared/errorMessage.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
+import { KeyingVerificationError } from "../../../../internal/crypto/index.js";
+import { verifyContainerWriterProjection } from "../../../../data/keyingProjectionVerification/container/containerProjectionVerification.js";
+import { runWithSecurityIncidentReporting } from "../../../../data/keyingProjectionVerification/error.js";
+import { rethrowProjectionVerificationCancelled } from "../../../../data/keyingProjectionVerification/types.js";
+import { hasUnsettledDocumentPlacement } from "../../../../data/persistence/container-contents/documentPurgePlacement.js";
+import { sqlDocumentsPersistence } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { errorMessage } from "../../../../data/shared/errorMessage.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
 import { assertLocalPurgeScope } from "./localPurgeScope.js";
 import { snapshotContainerStates } from "./purgeTreeCollection.js";
 import { readLocalPurgeScope } from "./readLocalPurgeScope.js";

package/workflows/container-contents/container-state/purge/purgeTreeScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purgeTreeScope.js","sourceRoot":"","sources":["purgeTreeScope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,yFAAyF,CAAC;AAC1I,OAAO,EAAE,gCAAgC,EAAE,MAAM,qDAAqD,CAAC;AACvG,OAAO,EAAE,sCAAsC,EAAE,MAAM,qDAAqD,CAAC;AAC7G,OAAO,EAAE,6BAA6B,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAI7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAW5D,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,OAAqD,EACrD,qBAAqD;IAErD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACtC,OAAO,gCAAgC,CACrC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;QACE,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,WAAW;QACvB,SAAS,EAAE,uBAAuB;KACnC,EACD,KAAK,IAAI,EAAE;QACT,OAAO,CAAC,SAAS,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,UAAU,GACd,MAAM,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IACE,UAAU,CAAC,WAAW,KAAK,QAAQ;YACnC,UAAU,CAAC,cAAc,KAAK,OAAO,CAAC,SAAS,CAAC,cAAc,EAC9D,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,+BAA+B,CAAC;YACjD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;YAC9B,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,eAAe,CACrD,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,0BAA0B,CAC/D,OAAO,CAAC,KAAK,CAAC,OAAO,EACrB,QAAQ,CACT,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,OAAO,GACX,SAAS,IAAI,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,iBAAiB;gBACtC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,QAAQ;YAC/D,MAAM,EAAE,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,QAAQ;YACzD,MAAM,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU;YACvD,CAAC,IAAI;iBACF,KAAK,CAAC,SAAS,CAAC;iBAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC3D,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CAAC;QACnC,IAAI,OAAO;YACT,qBAAqB,CAAC,GAAG,CACvB,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5D,CAAC;QACJ,OAAO,OAAO,CAAC;IACjB,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAA6B,EAC7B,qBAAqD;IAErD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,IAAI;QAC1E,OAAO,IAAI,CAAC;IACd,OAAO,mBAAmB,CAAC,KAAK,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,KAA6B,EAC7B,WAAmB,EACnB,qBAAqD,EACrD,aAAsB;IAEtB,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC;IACxD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IAChD,IAAI,SAAS,GAAkB,WAAW,CAAC;IAC3C,IAAI,sBAAsB,GAAG,KAAK,CAAC;IACnC,OAAO,SAAS,KAAK,eAAe,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,0BAA0B,CAC1D,OAAO,EACP,SAAS,CACV,CAAC;QACF,IACE,CAAC,QAAQ;YACT,CAAC,OAAO,EAAE,MAAM;YAChB,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC,SAAS,CAAC,QAAQ;YAC1D,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,cAAc;YACtE,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM,CAAC,UAAU;YAExD,OAAO,KAAK,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC9B,IACE,CAAC,CAAC,MAAM,mBAAmB,CACzB,KAAK,EACL;gBACE,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,EACD,qBAAqB,CACtB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,sBAAsB,GAAG,IAAI,CAAC;YAC9B,MAAM;QACR,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzC,CAAC;IACD,IACE,aAAa;QACb,CAAC,sBAAsB;QACvB,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAE7D,OAAO,KAAK,CAAC;IACf,OAAO,mBAAmB,CAAC;QACzB,GAAG,KAAK;QACR,WAAW;QACX,OAAO;QACP,qBAAqB;KACtB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAA6B;IAC3D,OAAO,IAAI,GAAG,CACZ,CACE,MAAM,KAAK,CAAC,WAAW,CAAC,uBAAuB,CAC7C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAC5B,CACF,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,KAA6B,EAC7B,QAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,IAAI,MAAM,6BAA6B,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,OAAO,EACP,QAAQ,CAAC,EAAE,CACZ,CAAC;IACF,OAAO,CACL,OAAO,KAAK,IAAI;QAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;QAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,uBAAuB,CAAC,OAA+B;IACrE,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO;QACV,cAAc,EAAE,uBAAuB,CAAC,OAAO,CAAC,cAAc,CAAC;KAChE,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAA6B,CAAC;IACnE,OAAO;QACL,6BAA6B,EAAE,CAAC,OAAgB,EAAE,WAAmB,EAAE,EAAE,CACvE,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,qBAAqB,CAAC;gBAC1B,GAAG,KAAK;gBACR,OAAO;gBACP,WAAW;gBACX,qBAAqB;aACtB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACJ,6BAA6B,EAAE,CAC7B,OAAgB,EAChB,WAAsC,EACtC,OAAe,EACf,EAAE,CACF,qBAAqB,CAAC;YACpB,GAAG,KAAK;YACR,OAAO;YACP,WAAW;YACX,OAAO;YACP,qBAAqB;SACtB,CAAC;QACJ,eAAe,EAAE,CAAC,WAAmB,EAAE,EAAE,CACvC,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,CAC9B,eAAe,CACb,KAAK,EACL,WAAW,EACX,qBAAqB,EACrB,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAC1D,CACF;QACH,cAAc,EAAE,CAAC,QAAyB,EAAE,EAAE,CAC5C,mBAAmB,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YACpC,IACE,CAAC,QAAQ,CAAC,WAAW;gBACrB,CAAC,CAAC,MAAM,0BAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAEpD,OAAO,KAAK,CAAC;YACf,IACE,CAAC,CAAC,MAAM,eAAe,CACrB,KAAK,EACL,QAAQ,CAAC,WAAW,EACpB,qBAAqB,EACrB,CAAC,QAAQ,CAAC,UAAU,CACrB,CAAC;gBAEF,OAAO,KAAK,CAAC;YACf,wEAAwE;YACxE,OAAO,mBAAmB,CACxB;gBACE,GAAG,KAAK;gBACR,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;gBACpC,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACpB,qBAAqB;aACtB,EACD,QAAQ,CACT,CAAC;QACJ,CAAC,CAAC;KACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,KAA6B,EAC7B,KAA6B;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,gDAAgD,YAAY,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import { KeyingVerificationError } from \"@tearleads/crypto\";\nimport type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport type { ProjectionUserKeyResolver } from \"../../../../data/keyingProjectionVerification\";\nimport { verifyContainerWriterProjection } from \"../../../../data/keyingProjectionVerification/container/containerProjectionVerification\";\nimport { runWithSecurityIncidentReporting } from \"../../../../data/keyingProjectionVerification/error\";\nimport { rethrowProjectionVerificationCancelled } from \"../../../../data/keyingProjectionVerification/types\";\nimport { hasUnsettledDocumentPlacement } from \"../../../../data/persistence/container-contents/documentPurgePlacement\";\nimport { sqlDocumentsPersistence } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport { errorMessage } from \"../../../../data/shared/errorMessage\";\nimport type { ExecSql } from \"../../../../data/sqlite/sqlSchema\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport type { ContainerContentsWorkflowRuntime } from \"../../runtime\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\nimport { snapshotContainerStates } from \"./purgeTreeCollection\";\nimport { readLocalPurgeScope } from \"./readLocalPurgeScope\";\n\ninterface SubtreePurgeScopeInput {\n  containersById: ReadonlyMap<string, ContainerState>;\n  persistence: ContainerContentsPersistence;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rootContainerId: string;\n  runtime: ContainerContentsWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}\n\nasync function verifiedRemoteScope(\n  input: SubtreePurgeScopeInput,\n  current: Pick<ContainerState, \"container\" | \"record\">,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n  const { runtime, rootContainerId } = input;\n  const targetId = current.container.id;\n  return runWithSecurityIncidentReporting(\n    runtime.util.reportSecurityIncident,\n    {\n      objectId: targetId,\n      objectKind: \"container\",\n      operation: \"container.purge.scope\",\n    },\n    async () => {\n      runtime.apiClient.evictContainerWriterProjection(targetId);\n      const projection =\n        await runtime.apiClient.getContainerWriterProjection(targetId);\n      if (!projection || input.stillCurrent?.() === false) return false;\n      if (\n        projection.containerId !== targetId ||\n        projection.organizationId !== current.container.organizationId\n      ) {\n        throw new KeyingVerificationError(\n          \"object_mismatch\",\n          \"Subtree purge container identity mismatch\",\n        );\n      }\n      const path = await verifyContainerWriterProjection({\n        execSql: runtime.infra.execSql,\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent: input.stillCurrent,\n        warmReferencedPrincipalPolicies:\n          createRuntimePrincipalPolicyWarmer(runtime),\n      });\n      const rootIndex = path.findIndex(\n        (head) => head.state.containerId === rootContainerId,\n      );\n      const latest = await input.persistence.loadContainerMetadataState(\n        runtime.infra.execSql,\n        targetId,\n      );\n      const pendingMoves = await readPendingMoves(input);\n      const allowed =\n        rootIndex >= 0 &&\n        path[rootIndex]?.state.parentContainerId ===\n          input.containersById.get(rootContainerId)?.container.parentId &&\n        latest?.container.parentId === current.container.parentId &&\n        latest.record?.documentId === current.record.documentId &&\n        !path\n          .slice(rootIndex)\n          .some((head) => pendingMoves.has(head.state.containerId)) &&\n        input.stillCurrent?.() !== false;\n      if (allowed)\n        verifiedAncestorsById.set(\n          targetId,\n          path.slice(rootIndex).map((head) => head.state.containerId),\n        );\n      return allowed;\n    },\n  );\n}\n\n/**\n * A local-only unit cites no signed request, so a remote ordinary root must\n * prove that it still sits under the parent it was selected from. A system\n * root's signed topology is fixed by its destination role.\n */\nasync function rootPlacementIsCurrent(\n  input: SubtreePurgeScopeInput,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n): Promise<boolean> {\n  const root = input.containersById.get(input.rootContainerId);\n  if (!root?.record.documentId || (root.container.systemSlot ?? null) !== null)\n    return true;\n  return verifiedRemoteScope(input, root, verifiedAncestorsById);\n}\n\nasync function allowsContainer(\n  input: SubtreePurgeScopeInput,\n  containerId: string,\n  verifiedAncestorsById: Map<string, readonly string[]>,\n  localOnlyUnit: boolean,\n): Promise<boolean> {\n  const { runtime, persistence, rootContainerId } = input;\n  if (input.stillCurrent?.() === false) return false;\n  const execSql = runtime.infra.execSql;\n  const pendingMoves = await readPendingMoves(input);\n  if (pendingMoves.has(rootContainerId)) return false;\n  const seen = new Set<string>([rootContainerId]);\n  let currentId: string | null = containerId;\n  let verifiedRemoteAncestry = false;\n  while (currentId !== rootContainerId) {\n    if (!currentId || seen.has(currentId) || pendingMoves.has(currentId))\n      return false;\n    seen.add(currentId);\n    const expected = input.containersById.get(currentId);\n    const current = await persistence.loadContainerMetadataState(\n      execSql,\n      currentId,\n    );\n    if (\n      !expected ||\n      !current?.record ||\n      current.container.parentId !== expected.container.parentId ||\n      current.container.organizationId !== expected.container.organizationId ||\n      current.record.documentId !== expected.record.documentId\n    )\n      return false;\n    if (current.record.documentId) {\n      if (\n        !(await verifiedRemoteScope(\n          input,\n          {\n            container: current.container,\n            record: current.record,\n          },\n          verifiedAncestorsById,\n        ))\n      )\n        return false;\n      verifiedRemoteAncestry = true;\n      break;\n    }\n    currentId = current.container.parentId;\n  }\n  if (\n    localOnlyUnit &&\n    !verifiedRemoteAncestry &&\n    !(await rootPlacementIsCurrent(input, verifiedAncestorsById))\n  )\n    return false;\n  return readLocalPurgeScope({\n    ...input,\n    containerId,\n    execSql,\n    verifiedAncestorsById,\n  });\n}\n\nasync function readPendingMoves(input: SubtreePurgeScopeInput) {\n  return new Set(\n    (\n      await input.persistence.listUnsyncedMoveIntents(\n        input.runtime.infra.execSql,\n      )\n    ).map((intent) => intent.containerId),\n  );\n}\n\nasync function documentPlacementIsCurrent(\n  input: SubtreePurgeScopeInput,\n  document: DocumentSummary,\n): Promise<boolean> {\n  const execSql = input.runtime.infra.execSql;\n  if (await hasUnsettledDocumentPlacement(execSql, document.id)) return false;\n  const current = await sqlDocumentsPersistence.loadDocument(\n    execSql,\n    document.id,\n  );\n  return (\n    current !== null &&\n    current.documentId === document.documentId &&\n    current.containerId === document.containerId &&\n    input.stillCurrent?.() !== false\n  );\n}\n\n/** Listing edges only select candidates; each destructive unit proves its scope. */\nexport function createSubtreePurgeScope(request: SubtreePurgeScopeInput) {\n  const input = {\n    ...request,\n    containersById: snapshotContainerStates(request.containersById),\n  };\n  const verifiedAncestorsById = new Map<string, readonly string[]>();\n  return {\n    allowsLocalScopeInTransaction: (execSql: ExecSql, containerId: string) =>\n      checkAvailableScope(input, async () => {\n        await assertLocalPurgeScope({\n          ...input,\n          execSql,\n          containerId,\n          verifiedAncestorsById,\n        });\n        return true;\n      }),\n    assertLocalScopeInTransaction: (\n      execSql: ExecSql,\n      containerId: string | null | undefined,\n      localId: string,\n    ) =>\n      assertLocalPurgeScope({\n        ...input,\n        execSql,\n        containerId,\n        localId,\n        verifiedAncestorsById,\n      }),\n    allowsContainer: (containerId: string) =>\n      checkAvailableScope(input, () =>\n        allowsContainer(\n          input,\n          containerId,\n          verifiedAncestorsById,\n          !input.containersById.get(containerId)?.record.documentId,\n        ),\n      ),\n    allowsDocument: (document: DocumentSummary) =>\n      checkAvailableScope(input, async () => {\n        if (\n          !document.containerId ||\n          !(await documentPlacementIsCurrent(input, document))\n        )\n          return false;\n        if (\n          !(await allowsContainer(\n            input,\n            document.containerId,\n            verifiedAncestorsById,\n            !document.documentId,\n          ))\n        )\n          return false;\n        // Freeze local placement checks together after all remote verification.\n        return readLocalPurgeScope(\n          {\n            ...input,\n            containerId: document.containerId,\n            execSql: input.runtime.infra.execSql,\n            localId: document.id,\n            verifiedAncestorsById,\n          },\n          document,\n        );\n      }),\n  };\n}\n\nasync function checkAvailableScope(\n  input: SubtreePurgeScopeInput,\n  check: () => Promise<boolean>,\n): Promise<boolean> {\n  try {\n    return await check();\n  } catch (error) {\n    rethrowProjectionVerificationCancelled(error);\n    if (error instanceof KeyingVerificationError) throw error;\n    input.runtime.util.log(\n      `Container contents: purge scope unavailable: ${errorMessage(error)}`,\n    );\n    return false;\n  }\n}\n"]}

package/workflows/container-contents/container-state/{readLocalPurgeScope.js → purge/readLocalPurgeScope.js}

@@ -1,6 +1,6 @@
-import { sqlDocumentsPersistence } from "../../../data/persistence/documents/documentsPersistence.js";
-import { getClientSQLitePersistenceRuntime } from "../../../data/sqlite/sqlitePersistenceRuntime.js";
-import { runSerializedSqlMutation } from "../../../data/sqlite/sqlSchema.js";
+import { sqlDocumentsPersistence } from "../../../../data/persistence/documents/documentsPersistence.js";
+import { getClientSQLitePersistenceRuntime } from "../../../../data/sqlite/sqlitePersistenceRuntime.js";
+import { runSerializedSqlMutation } from "../../../../data/sqlite/sqlSchema.js";
 import { assertLocalPurgeScope } from "./localPurgeScope.js";
 /** Final local scope check before HTTP dispatch, with no remote I/O under lock. */
 export function readLocalPurgeScope(input, document) {

package/workflows/container-contents/container-state/purge/readLocalPurgeScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readLocalPurgeScope.js","sourceRoot":"","sources":["readLocalPurgeScope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,6DAA6D,CAAC;AACtG,OAAO,EAAE,iCAAiC,EAAE,MAAM,kDAAkD,CAAC;AACrG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CACjC,KAAkD,EAClD,QAA0B;IAE1B,OAAO,wBAAwB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CACrE,iCAAiC,CAAC,aAAa,CAAC,CAAC,WAAW,CAC1D,KAAK,IAAI,EAAE;QACT,MAAM,qBAAqB,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,YAAY,CACxD,aAAa,EACb,QAAQ,CAAC,EAAE,CACZ,CAAC;QACF,OAAO,CACL,OAAO,KAAK,IAAI;YAChB,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAC1C,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;YAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,CACjC,CAAC;IACJ,CAAC,EACD,EAAE,QAAQ,EAAE,WAAW,EAAE,CAC1B,CACF,CAAC;AACJ,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../../../data/documents/documentSummary\";\nimport { sqlDocumentsPersistence } from \"../../../../data/persistence/documents/documentsPersistence\";\nimport { getClientSQLitePersistenceRuntime } from \"../../../../data/sqlite/sqlitePersistenceRuntime\";\nimport { runSerializedSqlMutation } from \"../../../../data/sqlite/sqlSchema\";\nimport { assertLocalPurgeScope } from \"./localPurgeScope\";\n\n/** Final local scope check before HTTP dispatch, with no remote I/O under lock. */\nexport function readLocalPurgeScope(\n  input: Parameters<typeof assertLocalPurgeScope>[0],\n  document?: DocumentSummary,\n): Promise<boolean> {\n  return runSerializedSqlMutation(input.execSql, async (lockedExecSql) =>\n    getClientSQLitePersistenceRuntime(lockedExecSql).transaction(\n      async () => {\n        await assertLocalPurgeScope({ ...input, execSql: lockedExecSql });\n        if (!document) return true;\n        const current = await sqlDocumentsPersistence.loadDocument(\n          lockedExecSql,\n          document.id,\n        );\n        return (\n          current !== null &&\n          current.documentId === document.documentId &&\n          current.containerId === document.containerId &&\n          input.stillCurrent?.() !== false\n        );\n      },\n      { behavior: \"immediate\" },\n    ),\n  );\n}\n"]}

package/workflows/container-contents/container-state/remote.js

@@ -1,11 +1,11 @@
 import { isContainerNotFoundFailure } from "../../../data/containers/shared/mutationFailures.js";
 import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
 import { moveRemoteContainer as moveRemoteContainerMutation, readContainerMutationMetadataDocumentId, referencedPrincipalHeadsFromContainerMutationResponse, shareRemoteContainer as shareRemoteContainerMutation, } from "../../containers/index.js";
-import { createRuntimeCurrentGroupShare } from "../../containers/child/runtimeCurrentGroupShare.js";
+import { createRuntimeCurrentGroupShare } from "../../containers/child/share/runtimeCurrentGroupShare.js";
 import { resolveDocumentCreateAuthor } from "../../documents/index.js";
 import { createRuntimeGroupMetadataAccess } from "../../organizations/groupMetadata/groupMetadataRuntime.js";
 import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { createRemoteContainerWithMetadataDocument, } from "./createWithMetadata.js";
+import { createRemoteContainerWithMetadataDocument, } from "./create/createWithMetadata.js";
 /**
  * Resolve the author, api client, executor, and encapsulation secret a remote
  * container mutation needs, logging a skip for the given operation when the

package/workflows/container-contents/container-state/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,uCAAuC,EACvC,qDAAqD,EACrD,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,sBAAsB,CAAC;AAQ9B;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC9C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,oBAAoB,EAAE,OAAO;QAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,kBAAkB,EAAE,uCAAuC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;QACtD,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY;QACjE,4BAA4B,EAC1B,qDAAqD,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACJ,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  moveRemoteContainer as moveRemoteContainerMutation,\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n  shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n  type ContainerAlreadyCommitted,\n  createRemoteContainerWithMetadataDocument,\n} from \"./createWithMetadata\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n  RemoteContainer,\n  SharedRemoteContainerState,\n} from \"./types\";\n\n/**\n * Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n  runtime: ContainerWorkflowRuntime,\n  operation:\n    | \"container create\"\n    | \"container group share\"\n    | \"container move\"\n    | \"container share\",\n) {\n  const author = resolveDocumentCreateAuthor(runtime);\n  const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !secretKey) {\n    runtime.util.log(\n      `Container contents: skipped ${operation} because the writer context is unavailable.`,\n    );\n    return null;\n  }\n\n  return {\n    apiClient: runtime.apiClient,\n    author,\n    execSql: runtime.infra.execSql,\n    secretKey,\n  };\n}\n\nexport async function createRemoteContainer(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n  previousProjection: ContainerWriterProjectionResponse,\n  response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n  if (\n    response.containerId !== previousProjection.containerId ||\n    response.organizationId !== previousProjection.organizationId\n  )\n    throw new Error(\"Container mutation response projection mismatch\");\n  return {\n    accessManifestHash: response.manifestHead.manifestHash,\n    accessEpoch: response.manifestHead.epoch,\n    createdAt: response.createdAt,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n    referencedPrincipalHeads:\n      referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n    updatedAt: response.updatedAt,\n    // The next read obtains the post-commit proof. A failed read cannot undo\n    // acknowledgement of this successful mutation.\n    writerProjection: null,\n  };\n}\n\nexport async function shareRemoteContainer(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shared = await shareRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    previousProjection: input.previousProjection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container group share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n  if (!shareWithGroup)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  const shared = await shareWithGroup({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    expectedGroupName: input.expectedGroupName ?? null,\n    readEncryptedName: (bundle) =>\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        author.organizationId,\n        input.stillCurrent,\n      ).readName(bundle),\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: input.previousProjection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    signingKeyPair: input.runtime.crypto.signingKeyPair,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function moveRemoteContainer(input: {\n  containerId: string;\n  parentContainerId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<RemoteContainer | null> {\n  const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const moved = await moveRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    destinationParentContainerId: input.parentContainerId,\n    execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!moved) {\n    return null;\n  }\n\n  return {\n    createdAt: moved.response.createdAt,\n    effectiveAccessLevel: \"admin\",\n    id: moved.response.containerId,\n    organizationId: moved.response.organizationId,\n    parentId: moved.response.parentId,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({\n      response: moved.response,\n    }),\n    metadataAccessEpoch: moved.response.manifestHead.epoch,\n    metadataAccessStateHash: moved.response.manifestHead.manifestHash,\n    metadataReferencedPrincipals:\n      referencedPrincipalHeadsFromContainerMutationResponse({\n        response: moved.response,\n      }),\n    updatedAt: moved.response.updatedAt,\n  };\n}\n\nexport async function deleteRemoteContainer(input: {\n  containerId: string;\n  organizationId: string;\n  requiredAncestorId?: string | undefined;\n  runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } | null> {\n  const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n    input.containerId,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n      requiredAncestorId: input.requiredAncestorId,\n    },\n  );\n  if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n    deleteResult.report();\n    return null;\n  }\n\n  if (!deleteResult.ok) {\n    // A 404 proves this immutable id is permanently absent, but it does not\n    // carry the server deletion time. A maximal fence prevents an older\n    // in-flight listing page from resurrecting it.\n    return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n  }\n\n  return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["remote.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAE9F,OAAO,EAAE,oCAAoC,EAAE,MAAM,kEAAkE,CAAC;AACxH,OAAO,EACL,mBAAmB,IAAI,2BAA2B,EAClD,uCAAuC,EACvC,qDAAqD,EACrD,oBAAoB,IAAI,4BAA4B,GACrD,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAC1G,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAEL,yCAAyC,GAC1C,MAAM,6BAA6B,CAAC;AAQrC;;;;GAIG;AACH,SAAS,6BAA6B,CACpC,OAAiC,EACjC,SAIqB;IAErB,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,+BAA+B,SAAS,6CAA6C,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;QAC9B,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAQ3C;IACC,OAAO,yCAAyC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sCAAsC,CAC7C,kBAAqD,EACrD,QAAmC;IAEnC,IACE,QAAQ,CAAC,WAAW,KAAK,kBAAkB,CAAC,WAAW;QACvD,QAAQ,CAAC,cAAc,KAAK,kBAAkB,CAAC,cAAc;QAE7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,OAAO;QACL,kBAAkB,EAAE,QAAQ,CAAC,YAAY,CAAC,YAAY;QACtD,WAAW,EAAE,QAAQ,CAAC,YAAY,CAAC,KAAK;QACxC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,kBAAkB,EAAE,uCAAuC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACzE,wBAAwB,EACtB,qDAAqD,CAAC,EAAE,QAAQ,EAAE,CAAC;QACrE,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,yEAAyE;QACzE,+CAA+C;QAC/C,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAQ1C;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QAChD,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,MAAM,GAAG,6BAA6B,CAC1C,KAAK,CAAC,OAAO,EACb,uBAAuB,CACxB,CAAC;IACF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,cAAc,GAAG,8BAA8B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,CAAC,cAAc;QACjB,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO;QACP,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,gCAAgC,CAC9B,KAAK,CAAC,OAAO,EACb,MAAM,CAAC,cAAc,EACrB,KAAK,CAAC,YAAY,CACnB,CAAC,QAAQ,CAAC,MAAM,CAAC;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,0BAA0B,EAAE,KAAK,CAAC,OAAO,CAAC,0BAA0B;QACpE,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;QACnD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,sCAAsC,CAC3C,KAAK,CAAC,kBAAkB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAMzC;IACC,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE1E,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC9C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB;QACjE,SAAS;QACT,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,4BAA4B,EAAE,KAAK,CAAC,iBAAiB;QACrD,OAAO;QACP,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe;QACf,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;QACnC,oBAAoB,EAAE,OAAO;QAC7B,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACjC,kBAAkB,EAAE,uCAAuC,CAAC;YAC1D,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,mBAAmB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK;QACtD,uBAAuB,EAAE,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY;QACjE,4BAA4B,EAC1B,qDAAqD,CAAC;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACJ,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IACC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CACtE,KAAK,CAAC,WAAW,EACjB;QACE,qCAAqC,EAAE,KAAK,CAAC,cAAc;QAC3D,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IACF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,0BAA0B,CAAC,YAAY,CAAC,EAAE,CAAC;QAClE,YAAY,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,wEAAwE;QACxE,oEAAoE;QACpE,+CAA+C;QAC/C,OAAO,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;AACpD,CAAC","sourcesContent":["import type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n  ContainerMutationResponse,\n  ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport type { ProjectionUserKeyResolver } from \"../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport {\n  moveRemoteContainer as moveRemoteContainerMutation,\n  readContainerMutationMetadataDocumentId,\n  referencedPrincipalHeadsFromContainerMutationResponse,\n  shareRemoteContainer as shareRemoteContainerMutation,\n} from \"../../containers\";\nimport { createRuntimeCurrentGroupShare } from \"../../containers/child/share/runtimeCurrentGroupShare\";\nimport { resolveDocumentCreateAuthor } from \"../../documents\";\nimport { createRuntimeGroupMetadataAccess } from \"../../organizations/groupMetadata/groupMetadataRuntime\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../principals/runtimePolicyWarmer\";\nimport {\n  type ContainerAlreadyCommitted,\n  createRemoteContainerWithMetadataDocument,\n} from \"./create/createWithMetadata\";\nimport type {\n  ContainerWorkflowRuntime,\n  CreatedRemoteContainerState,\n  RemoteContainer,\n  SharedRemoteContainerState,\n} from \"./types\";\n\n/**\n * Resolve the author, api client, executor, and encapsulation secret a remote\n * container mutation needs, logging a skip for the given operation when the\n * writer context is unavailable.\n */\nfunction resolveContainerWriterContext(\n  runtime: ContainerWorkflowRuntime,\n  operation:\n    | \"container create\"\n    | \"container group share\"\n    | \"container move\"\n    | \"container share\",\n) {\n  const author = resolveDocumentCreateAuthor(runtime);\n  const secretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  if (!author || !secretKey) {\n    runtime.util.log(\n      `Container contents: skipped ${operation} because the writer context is unavailable.`,\n    );\n    return null;\n  }\n\n  return {\n    apiClient: runtime.apiClient,\n    author,\n    execSql: runtime.infra.execSql,\n    secretKey,\n  };\n}\n\nexport async function createRemoteContainer(input: {\n  systemSlot?: ContainerSystemSlot | null | undefined;\n  containerId: string;\n  parentContainerId: string;\n  parentProjection?: ContainerWriterProjectionResponse | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<CreatedRemoteContainerState | ContainerAlreadyCommitted | null> {\n  return createRemoteContainerWithMetadataDocument(input);\n}\n\nfunction sharedRemoteContainerStateFromMutation(\n  previousProjection: ContainerWriterProjectionResponse,\n  response: ContainerMutationResponse,\n): SharedRemoteContainerState {\n  if (\n    response.containerId !== previousProjection.containerId ||\n    response.organizationId !== previousProjection.organizationId\n  )\n    throw new Error(\"Container mutation response projection mismatch\");\n  return {\n    accessManifestHash: response.manifestHead.manifestHash,\n    accessEpoch: response.manifestHead.epoch,\n    createdAt: response.createdAt,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({ response }),\n    referencedPrincipalHeads:\n      referencedPrincipalHeadsFromContainerMutationResponse({ response }),\n    updatedAt: response.updatedAt,\n    // The next read obtains the post-commit proof. A failed read cannot undo\n    // acknowledgement of this successful mutation.\n    writerProjection: null,\n  };\n}\n\nexport async function shareRemoteContainer(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shared = await shareRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    previousProjection: input.previousProjection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function shareRemoteContainerWithGroup(input: {\n  accessLevel: \"read\" | \"write\" | \"admin\";\n  containerId: string;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  previousProjection: ContainerWriterProjectionResponse;\n  recipientGroupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedRemoteContainerState | null> {\n  const writer = resolveContainerWriterContext(\n    input.runtime,\n    \"container group share\",\n  );\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const shareWithGroup = createRuntimeCurrentGroupShare(input.runtime);\n  if (!shareWithGroup)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  const shared = await shareWithGroup({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    accessLevel: input.accessLevel,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    execSql,\n    expectedGroupName: input.expectedGroupName ?? null,\n    readEncryptedName: (bundle) =>\n      createRuntimeGroupMetadataAccess(\n        input.runtime,\n        author.organizationId,\n        input.stillCurrent,\n      ).readName(bundle),\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: input.previousProjection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    resolveTrustedUserIdentity: input.runtime.resolveTrustedUserIdentity,\n    signingKeyPair: input.runtime.crypto.signingKeyPair,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!shared) {\n    return null;\n  }\n\n  return sharedRemoteContainerStateFromMutation(\n    input.previousProjection,\n    shared.response,\n  );\n}\n\nexport async function moveRemoteContainer(input: {\n  containerId: string;\n  parentContainerId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<RemoteContainer | null> {\n  const writer = resolveContainerWriterContext(input.runtime, \"container move\");\n  if (!writer) {\n    return null;\n  }\n  const { apiClient, author, execSql, secretKey: targetSecretKey } = writer;\n\n  const moved = await moveRemoteContainerMutation({\n    reportSecurityIncident: input.runtime.util.reportSecurityIncident,\n    apiClient,\n    author,\n    containerId: input.containerId,\n    destinationParentContainerId: input.parentContainerId,\n    execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.stillCurrent,\n    targetSecretKey,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (!moved) {\n    return null;\n  }\n\n  return {\n    createdAt: moved.response.createdAt,\n    effectiveAccessLevel: \"admin\",\n    id: moved.response.containerId,\n    organizationId: moved.response.organizationId,\n    parentId: moved.response.parentId,\n    metadataDocumentId: readContainerMutationMetadataDocumentId({\n      response: moved.response,\n    }),\n    metadataAccessEpoch: moved.response.manifestHead.epoch,\n    metadataAccessStateHash: moved.response.manifestHead.manifestHash,\n    metadataReferencedPrincipals:\n      referencedPrincipalHeadsFromContainerMutationResponse({\n        response: moved.response,\n      }),\n    updatedAt: moved.response.updatedAt,\n  };\n}\n\nexport async function deleteRemoteContainer(input: {\n  containerId: string;\n  organizationId: string;\n  requiredAncestorId?: string | undefined;\n  runtime: ContainerWorkflowRuntime;\n}): Promise<{ deletedAt: string } | null> {\n  const deleteResult = await input.runtime.apiClient.deleteContainerResult(\n    input.containerId,\n    {\n      expectedPaymentRequiredOrganizationId: input.organizationId,\n      reportErrors: false,\n      requiredAncestorId: input.requiredAncestorId,\n    },\n  );\n  if (!deleteResult.ok && !isContainerNotFoundFailure(deleteResult)) {\n    deleteResult.report();\n    return null;\n  }\n\n  if (!deleteResult.ok) {\n    // A 404 proves this immutable id is permanently absent, but it does not\n    // carry the server deletion time. A maximal fence prevents an older\n    // in-flight listing page from resurrecting it.\n    return { deletedAt: \"9999-12-31T23:59:59.999Z\" };\n  }\n\n  return { deletedAt: deleteResult.data.deletedAt };\n}\n"]}

package/workflows/container-contents/container-state/{groupGrantVerification.js → share/groupGrantVerification.js}

@@ -1,11 +1,11 @@
-import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
-import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { principalPolicyCacheForVerifiedPolicies } from "../../../data/keyingProjectionVerification/principalPolicyCache.js";
-import { referencedPrincipalHeadFromPolicy } from "../../containers/index.js";
-import { createRuntimeCurrentSharePrincipalPolicy } from "../../containers/child/currentSharePrincipalPolicy.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { loadContainerWriterProjectionForState } from "./projectionCache.js";
+import { getTargetContainerContext, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { principalPolicyCacheForVerifiedPolicies } from "../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache.js";
+import { referencedPrincipalHeadFromPolicy } from "../../../containers/index.js";
+import { createRuntimeCurrentSharePrincipalPolicy } from "../../../containers/child/share/currentSharePrincipalPolicy.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
+import { loadContainerWriterProjectionForState } from "../projectionCache.js";
 function projectionHasCurrentGroupGrant(input) {
     const state = readContainerState(getTargetContainerContext(input.projection).manifest);
     return (state.containerId === input.expectedContainerId &&

package/workflows/container-contents/container-state/share/groupGrantVerification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupGrantVerification.js","sourceRoot":"","sources":["groupGrantVerification.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,uCAAuC,EAAE,MAAM,oFAAoF,CAAC;AAC7I,OAAO,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AACvH,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,EAAE,qCAAqC,EAAE,MAAM,oBAAoB,CAAC;AAK3E,SAAS,8BAA8B,CAAC,KASvC;IACC,MAAM,KAAK,GAAG,kBAAkB,CAC9B,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CACrD,CAAC;IACF,OAAO,CACL,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QAC/C,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB;QACrD,KAAK,CAAC,YAAY,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C;QACD,KAAK,CAAC,wBAAwB,CAAC,IAAI,CACjC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,WAAW,CAAC,aAAa;YACtD,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW;YAClD,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,OAAO;YAC1C,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,WAAW,CAAC,QAAQ;YAC5C,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,WAAW,CAAC,SAAS;YAC9C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,WAAW,CAAC,cAAc,CAC3D,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0CAA0C,CAAC,KAUzD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IACE,CAAC,UAAU;QACX,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAChC,KAAK,CAAC,iBAAiB,CAAC,aAAa,KAAK,OAAO;QACjD,KAAK,CAAC,iBAAiB,CAAC,WAAW,KAAK,KAAK,CAAC,OAAO;QACrD,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,mBAAmB;QAC/D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC3C,KAAK,CAAC,sBAAsB;QAC9B,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,mBAAmB;QACpD,UAAU,CAAC,cAAc,KAAK,KAAK,CAAC,sBAAsB,EAC1D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,OAAO,WAAW,CAChB;QACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,sBAAsB;QAC5C,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;QACrD,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,oBAAoB,EAClB,uCAAuC,CAAC,kBAAkB,CAAC;YAC7D,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY;YACZ,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,OAAO,8BAA8B,CAAC;YACpC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,iCAAiC,CAAC,MAAM,CAAC;YACtD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU;SACX,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,KAAuE;IAEvE,OAAO,CACL,CAAC,MAAM,wCAAwC,CAAC,GAAG,EAAE,CACnD,0CAA0C,CAAC,KAAK,CAAC,CAClD,CAAC,IAAI,KAAK,CACZ,CAAC;AACJ,CAAC","sourcesContent":["import type { ReferencedPrincipalHead } from \"@tearleads/crypto\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { principalPolicyCacheForVerifiedPolicies } from \"../../../../data/keyingProjectionVerification/principalPolicy/principalPolicyCache\";\nimport { referencedPrincipalHeadFromPolicy } from \"../../../containers\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"../../../containers/child/share/currentSharePrincipalPolicy\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"../projectionCache\";\nimport type { ContainerWorkflowRuntime } from \"../types\";\n\ntype GroupGrantAccessLevel = \"read\" | \"write\" | \"admin\";\n\nfunction projectionHasCurrentGroupGrant(input: {\n  accessLevel: GroupGrantAccessLevel;\n  expectedContainerId: string;\n  expectedOrganizationId: string;\n  groupId: string;\n  currentHead: ReferencedPrincipalHead;\n  projection: NonNullable<\n    Awaited<ReturnType<typeof loadContainerWriterProjectionForState>>\n  >;\n}): boolean {\n  const state = readContainerState(\n    getTargetContainerContext(input.projection).manifest,\n  );\n  return (\n    state.containerId === input.expectedContainerId &&\n    state.organizationId === input.expectedOrganizationId &&\n    state.directGrants.some(\n      (grant) =>\n        grant.subjectType === \"group\" &&\n        grant.subjectId === input.groupId &&\n        grant.accessLevel === input.accessLevel,\n    ) &&\n    state.referencedPrincipalHeads.some(\n      (head) =>\n        head.principalType === input.currentHead.principalType &&\n        head.principalId === input.currentHead.principalId &&\n        head.version === input.currentHead.version &&\n        head.keyEpoch === input.currentHead.keyEpoch &&\n        head.stateHash === input.currentHead.stateHash &&\n        head.keyFingerprint === input.currentHead.keyFingerprint,\n    )\n  );\n}\n\nasync function containerStateHasCurrentGroupGrantInternal(input: {\n  accessLevel: GroupGrantAccessLevel;\n  containerState: ContainerState;\n  expectedContainerId: string;\n  expectedGroupHead: ReferencedPrincipalHead;\n  expectedOrganizationId: string;\n  groupId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<boolean> {\n  if (input.stillCurrent?.() === false) return false;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (\n    !projection ||\n    input.stillCurrent?.() === false ||\n    input.expectedGroupHead.principalType !== \"group\" ||\n    input.expectedGroupHead.principalId !== input.groupId ||\n    input.containerState.container.id !== input.expectedContainerId ||\n    input.containerState.container.organizationId !==\n      input.expectedOrganizationId ||\n    projection.containerId !== input.expectedContainerId ||\n    projection.organizationId !== input.expectedOrganizationId\n  ) {\n    return false;\n  }\n\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);\n  if (!readCurrent)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  return readCurrent(\n    {\n      expectedGroupHead: input.expectedGroupHead,\n      groupId: input.groupId,\n      organizationId: input.expectedOrganizationId,\n      stillCurrent: input.stillCurrent ?? (() => true),\n    },\n    async ({ checkpointPolicies, policy, stillCurrent }) => {\n      await verifyContainerWriterProjection({\n        execSql: input.runtime.infra.execSql,\n        principalPolicyCache:\n          principalPolicyCacheForVerifiedPolicies(checkpointPolicies),\n        projection,\n        resolveUserKey: input.resolveProjectionUserKey,\n        stillCurrent,\n        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n          input.runtime,\n        ),\n      });\n      return projectionHasCurrentGroupGrant({\n        accessLevel: input.accessLevel,\n        currentHead: referencedPrincipalHeadFromPolicy(policy),\n        expectedContainerId: input.expectedContainerId,\n        expectedOrganizationId: input.expectedOrganizationId,\n        groupId: input.groupId,\n        projection,\n      });\n    },\n  );\n}\n\nexport async function containerStateHasCurrentGroupGrant(\n  input: Parameters<typeof containerStateHasCurrentGroupGrantInternal>[0],\n): Promise<boolean> {\n  return (\n    (await nullOnProjectionVerificationCancellation(() =>\n      containerStateHasCurrentGroupGrantInternal(input),\n    )) ?? false\n  );\n}\n"]}

package/workflows/container-contents/container-state/{groupShareEpoch.js → share/groupShareEpoch.js}

@@ -1,5 +1,5 @@
-import { ProjectionDependencyUnavailableError } from "../../../data/keyingProjectionVerification/dependencyUnavailable.js";
-import { createRuntimeCurrentSharePrincipalPolicy } from "../../containers/child/currentSharePrincipalPolicy.js";
+import { ProjectionDependencyUnavailableError } from "../../../../data/keyingProjectionVerification/dependencyUnavailable.js";
+import { createRuntimeCurrentSharePrincipalPolicy } from "../../../containers/child/share/currentSharePrincipalPolicy.js";
 export async function resolveCurrentGroupKeyEpoch(input) {
     if (input.stillCurrent?.() === false)
         return null;

package/workflows/container-contents/container-state/share/groupShareEpoch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groupShareEpoch.js","sourceRoot":"","sources":["groupShareEpoch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,MAAM,qEAAqE,CAAC;AAC3H,OAAO,EAAE,wCAAwC,EAAE,MAAM,6DAA6D,CAAC;AAGvH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAQjD;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,WAAW,GAAG,wCAAwC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,CAAC,WAAW;QACd,MAAM,IAAI,oCAAoC,CAC5C,+CAA+C,CAChD,CAAC;IACJ,OAAO,WAAW,CAChB;QACE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KACjD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CACtC,CAAC;AACJ,CAAC","sourcesContent":["import { ProjectionDependencyUnavailableError } from \"../../../../data/keyingProjectionVerification/dependencyUnavailable\";\nimport { createRuntimeCurrentSharePrincipalPolicy } from \"../../../containers/child/share/currentSharePrincipalPolicy\";\nimport type { ContainerWorkflowRuntime } from \"../types\";\n\nexport async function resolveCurrentGroupKeyEpoch(input: {\n  // Bound here, in the one verified load a duplicate share performs, so a\n  // duplicate never reports success for a group the user did not choose.\n  expectedGroupName?: string | undefined;\n  groupId: string;\n  organizationId: string;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<number | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const readCurrent = createRuntimeCurrentSharePrincipalPolicy(input.runtime);\n  if (!readCurrent)\n    throw new ProjectionDependencyUnavailableError(\n      \"Group sharing requires private paged recovery\",\n    );\n  return readCurrent(\n    {\n      expectedGroupName: input.expectedGroupName,\n      groupId: input.groupId,\n      organizationId: input.organizationId,\n      stillCurrent: input.stillCurrent ?? (() => true),\n    },\n    async ({ policy }) => policy.keyEpoch,\n  );\n}\n"]}

package/workflows/container-contents/container-state/{share.js → share/index.js}

@@ -1,11 +1,11 @@
-import { getTargetContainerContext, readContainerState, } from "../../../data/containers/shared/projection.js";
-import { unwrapContainerKekPath } from "../../../data/documents/shared/projection.js";
-import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../data/keyingProjectionVerification/index.js";
-import { createRuntimePrincipalPolicyWarmer } from "../../principals/runtimePolicyWarmer.js";
-import { projectionGeneration } from "../projectionGeneration.js";
+import { getTargetContainerContext, readContainerState, } from "../../../../data/containers/shared/projection.js";
+import { unwrapContainerKekPath } from "../../../../data/documents/shared/projection.js";
+import { nullOnProjectionVerificationCancellation, verifyContainerWriterProjection, } from "../../../../data/keyingProjectionVerification/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../../../principals/runtimePolicyWarmer.js";
+import { projectionGeneration } from "../../projectionGeneration.js";
+import { loadContainerWriterProjectionForState } from "../projectionCache.js";
+import { shareRemoteContainer, shareRemoteContainerWithGroup } from "../remote.js";
 import { resolveCurrentGroupKeyEpoch } from "./groupShareEpoch.js";
-import { loadContainerWriterProjectionForState } from "./projectionCache.js";
-import { shareRemoteContainer, shareRemoteContainerWithGroup } from "./remote.js";
 import { persistDuplicateContainerShare, persistSharedContainerState, } from "./sharePersistence.js";
 function readOptionalProjectionString(projection, key) {
     const value = Reflect.get(projection, key);
@@ -280,4 +280,4 @@ export async function shareContainerStateWithGroup(input) {
         writerProjectionGeneration,
     });
 }
-//# sourceMappingURL=share.js.map
+//# sourceMappingURL=index.js.map

package/workflows/container-contents/container-state/share/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AACtF,OAAO,EACL,wCAAwC,EAExC,+BAA+B,GAChC,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAC;AAE7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,qCAAqC,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,WAAW,CAAC;AAKhF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAEL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAU5B,SAAS,4BAA4B,CACnC,UAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,KAI1B;IACC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,CAC5D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,KAU9C;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CACpD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QACnC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,+CAA+C,KAAK,CAAC,WAAW,cAAc,KAAK,CAAC,SAAS,iBAAiB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,kDAAkD,CAClM,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IACE,KAAK,CAAC,WAAW,KAAK,OAAO;QAC7B,KAAK,CAAC,oBAAoB;QAC1B,KAAK,CAAC,wBAAwB,EAC9B,CAAC;QACD,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,gDAAgD,CAC5J,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,WAAW,CAAC,wBAAwB,CAAC,IAAI,CAC1D,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,aAAa,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,CACzE,CAAC;QACF,MAAM,eAAe,GAAG,UAAU;YAChC,CAAC,CAAC,MAAM,2BAA2B,CAAC;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,OAAO,EAAE,KAAK,CAAC,SAAS;gBACxB,cAAc,EAAE,WAAW,CAAC,cAAc;gBAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,IACE,CAAC,UAAU;YACX,CAAC,eAAe,KAAK,IAAI;gBACvB,iBAAiB,CAAC;oBAChB,eAAe;oBACf,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;oBAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAC,CAAC,EACL,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,4CAA4C,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,SAAS,uDAAuD,CACnK,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO;QACL,aAAa,EAAE;YACb,WAAW,EAAE,WAAW,CAAC,KAAK;YAC9B,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY;YAC7C,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;YAChE,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;YAClD,wBAAwB,EAAE,WAAW,CAAC,wBAAwB;YAC9D,SAAS,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,CAAC;SACjE;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wCAAwC,CAAC,KAQvD;IAQC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,qCAAqC,CAAC;QAC7D,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,+BAA+B,CAAC;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,UAAU;YACV,cAAc,EAAE,KAAK,CAAC,wBAAwB;YAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;SACF,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAClD,MAAM,aAAa,GAAG,kBAAkB,CACtC,yBAAyB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC/C,CAAC;QACF,IACE,UAAU,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC5D,UAAU,CAAC,cAAc;gBACvB,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,WAAW,KAAK,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;YAC/D,aAAa,CAAC,cAAc;gBAC1B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,cAAc;YAC/C,aAAa,CAAC,iBAAiB;gBAC7B,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,QAAQ,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CAC9C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,OAAO;YAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,OAAO;YACjC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,UAAU;QACV,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,SAAS,EAAE,eAAe;QAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;KACF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACpE,OAAO,SAAS;QACd,CAAC,CAAC;YACE,kBAAkB,EAAE,IAAI,GAAG,CAAC;gBAC1B,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,SAAS,CAAC;aAC5C,CAAC;YACF,MAAM,EAAE,UAAU;SACnB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAqE;IAErE,OAAO,wCAAwC,CAAC,GAAG,EAAE,CACnD,wCAAwC,CAAC,KAAK,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,eAAe;QAChC,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,cAAc,KAAK,CAAC,eAAe,EAAE,CACpI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAelD;IACC,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAClD,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,0BAA0B,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,wBAAwB,EACtB,KAAK,CAAC,oBAAoB,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,gBAAgB;QACjC,WAAW,EAAE,OAAO;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,YAAY,CAAC,aAAa,EAAE,CAAC;QAC/B,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,uCAAuC;QACvC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,6DAA6D,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,eAAe,KAAK,CAAC,gBAAgB,EAAE,CACtI,CAAC;QACF,OAAO,8BAA8B,CAAC;YACpC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,KAAK,EAAE,YAAY,CAAC,aAAa;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,YAAY,CAAC,UAAU;YACnC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,0BAA0B;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE;QAC9C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,UAAU;QAC3C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAErE,OAAO,2BAA2B,CAAC;QACjC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type {\n  ContainerWriterProjectionResponse,\n  ReferencedPrincipalStateResponse,\n} from \"@tearleads/validators/response\";\nimport {\n  getTargetContainerContext,\n  readContainerState,\n} from \"../../../../data/containers/shared/projection\";\nimport { unwrapContainerKekPath } from \"../../../../data/documents/shared/projection\";\nimport {\n  nullOnProjectionVerificationCancellation,\n  type ProjectionUserKeyResolver,\n  verifyContainerWriterProjection,\n} from \"../../../../data/keyingProjectionVerification\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../../../principals/runtimePolicyWarmer\";\nimport type { ContainerContentsPersistence } from \"../../containerPersistence\";\nimport { projectionGeneration } from \"../../projectionGeneration\";\nimport type { ContainerState } from \"../../remoteHydration\";\nimport { loadContainerWriterProjectionForState } from \"../projectionCache\";\nimport { shareRemoteContainer, shareRemoteContainerWithGroup } from \"../remote\";\nimport type {\n  ContainerWorkflowRuntime,\n  SharedContainerStateResult,\n} from \"../types\";\nimport { resolveCurrentGroupKeyEpoch } from \"./groupShareEpoch\";\nimport {\n  type MatchingRemoteContainerGrant,\n  persistDuplicateContainerShare,\n  persistSharedContainerState,\n} from \"./sharePersistence\";\n\ntype ContainerShareSubjectType = \"group\" | \"user\";\ntype ContainerShareAccessLevel = \"read\" | \"write\" | \"admin\";\n\ninterface RemoteContainerShareContext {\n  matchingGrant: MatchingRemoteContainerGrant | null;\n  projection: ContainerWriterProjectionResponse;\n}\n\nfunction readOptionalProjectionString(\n  projection: ContainerWriterProjectionResponse,\n  key: string,\n): string | null {\n  const value = Reflect.get(projection, key);\n  return typeof value === \"string\" && value.length > 0 ? value : null;\n}\n\n// A container's KEK is wrapped to a group's encapsulation key at a specific key\n// epoch, pinned into the manifest as a referenced principal head. When the group\n// rotates (org-admin add or any removal bumps the epoch and mints a fresh KEM\n// keypair), that wrap goes stale: members holding only the new epoch secret can\n// no longer unwrap it. A re-share to the same group at the same access level is\n// therefore NOT redundant when the pinned epoch trails the group's current head,\n// so it must not be deduped away. The current epoch comes from a network-fresh,\n// fully verified current policy guarded by durable local checkpoints.\nfunction groupGrantIsStale(input: {\n  currentKeyEpoch: number;\n  referencedPrincipalHeads: ReadonlyArray<ReferencedPrincipalStateResponse>;\n  subjectId: string;\n}): boolean {\n  const pinnedHead = (input.referencedPrincipalHeads ?? []).find(\n    (head) =>\n      head.principalType === \"group\" && head.principalId === input.subjectId,\n  );\n  if (!pinnedHead) {\n    return true;\n  }\n  return pinnedHead.keyEpoch !== input.currentKeyEpoch;\n}\n\nasync function loadRemoteContainerShareContext(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  forceExistingGrantRewrap?: boolean | undefined;\n  requireExistingGrant?: boolean | undefined;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n  subjectId: string;\n  subjectType: ContainerShareSubjectType;\n}): Promise<RemoteContainerShareContext | null> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const remoteState = readContainerState(target.manifest);\n  const hasMatchingGrant = remoteState.directGrants.some(\n    (grant) =>\n      grant.subjectType === input.subjectType &&\n      grant.subjectId === input.subjectId &&\n      grant.accessLevel === input.accessLevel,\n  );\n  if (!hasMatchingGrant) {\n    if (input.requireExistingGrant) {\n      // Re-wrap-only callers must never mint a brand-new grant: the container's\n      // system slot is server-supplied and could point at a container that does\n      // not already grant this subject, so minting here would leak its contents.\n      input.runtime.util.log(\n        `Container contents: refused to create a new ${input.subjectType} grant for ${input.subjectId} on container ${input.containerState.container.id} because the re-share requires an existing grant`,\n      );\n      return null;\n    }\n    return { matchingGrant: null, projection };\n  }\n\n  if (\n    input.subjectType === \"group\" &&\n    input.requireExistingGrant &&\n    input.forceExistingGrantRewrap\n  ) {\n    // The cheap epoch probe below reads an unverified response and cannot prove\n    // that a security-critical re-wrap is current. Force the verified policy\n    // load and a real same-level mutation; failures must reach the retry owner.\n    input.runtime.util.log(\n      `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because an existing grant re-wrap is required`,\n    );\n    return { matchingGrant: null, projection };\n  }\n\n  if (input.subjectType === \"group\") {\n    const pinnedHead = remoteState.referencedPrincipalHeads.find(\n      (head) =>\n        head.principalType === \"group\" && head.principalId === input.subjectId,\n    );\n    const currentKeyEpoch = pinnedHead\n      ? await resolveCurrentGroupKeyEpoch({\n          expectedGroupName: input.expectedGroupName,\n          groupId: input.subjectId,\n          organizationId: remoteState.organizationId,\n          runtime: input.runtime,\n          stillCurrent: input.stillCurrent,\n        })\n      : null;\n    if (input.stillCurrent?.() === false) return null;\n    if (\n      !pinnedHead ||\n      (currentKeyEpoch !== null &&\n        groupGrantIsStale({\n          currentKeyEpoch,\n          referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n          subjectId: input.subjectId,\n        }))\n    ) {\n      input.runtime.util.log(\n        `Container contents: re-sharing container ${input.containerState.container.id} with group ${input.subjectId} because its key epoch advanced past the pinned grant`,\n      );\n      return { matchingGrant: null, projection };\n    }\n  }\n\n  return {\n    matchingGrant: {\n      accessEpoch: remoteState.epoch,\n      accessStateHash: target.manifest.manifestHash,\n      createdAt: readOptionalProjectionString(projection, \"createdAt\"),\n      metadataDocumentId: remoteState.metadataDocumentId,\n      referencedPrincipalHeads: remoteState.referencedPrincipalHeads,\n      updatedAt: readOptionalProjectionString(projection, \"updatedAt\"),\n    },\n    projection,\n  };\n}\n\nasync function prepareContainerStateGroupRewrapInternal(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  groupId: string;\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<\n  | { status: \"not-granted\" }\n  | {\n      knownContainerKeks: ReadonlyMap<string, Uint8Array>;\n      status: \"prepared\";\n    }\n  | null\n> {\n  if (input.stillCurrent?.() === false) return null;\n  const projection = await loadContainerWriterProjectionForState({\n    containerState: input.containerState,\n    runtime: input.runtime,\n  });\n  if (!projection || input.stillCurrent?.() === false) {\n    return null;\n  }\n\n  if (input.requireExistingGrant) {\n    await verifyContainerWriterProjection({\n      execSql: input.runtime.infra.execSql,\n      projection,\n      resolveUserKey: input.resolveProjectionUserKey,\n      stillCurrent: input.stillCurrent,\n      warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n        input.runtime,\n      ),\n    });\n    if (input.stillCurrent?.() === false) return null;\n    const verifiedState = readContainerState(\n      getTargetContainerContext(projection).manifest,\n    );\n    if (\n      projection.containerId !== input.containerState.container.id ||\n      projection.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.containerId !== input.containerState.container.id ||\n      verifiedState.organizationId !==\n        input.containerState.container.organizationId ||\n      verifiedState.parentContainerId !==\n        input.containerState.container.parentId\n    ) {\n      throw new Error(\n        \"Prepared container group re-wrap target is inconsistent\",\n      );\n    }\n    const hasGrant = verifiedState.directGrants.some(\n      (grant) =>\n        grant.subjectType === \"group\" &&\n        grant.subjectId === input.groupId &&\n        grant.accessLevel === input.accessLevel,\n    );\n    if (!hasGrant) {\n      return { status: \"not-granted\" };\n    }\n  }\n\n  const targetSecretKey =\n    input.runtime.crypto.encapsulationKeyPair?.secretKey ?? null;\n  if (!targetSecretKey) {\n    return null;\n  }\n\n  const target = getTargetContainerContext(projection);\n  const keksByEpochId = await unwrapContainerKekPath({\n    execSql: input.runtime.infra.execSql,\n    projection,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    secretKey: targetSecretKey,\n    stillCurrent: input.stillCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n  });\n  if (input.stillCurrent?.() === false) return null;\n  const targetKek = keksByEpochId.get(target.kek.containerKeyEpochId);\n  return targetKek\n    ? {\n        knownContainerKeks: new Map([\n          [target.kek.containerKeyEpochId, targetKek],\n        ]),\n        status: \"prepared\",\n      }\n    : null;\n}\n\nexport function prepareContainerStateGroupRewrap(\n  input: Parameters<typeof prepareContainerStateGroupRewrapInternal>[0],\n): ReturnType<typeof prepareContainerStateGroupRewrapInternal> {\n  return nullOnProjectionVerificationCancellation(() =>\n    prepareContainerStateGroupRewrapInternal(input),\n  );\n}\n\nexport async function shareContainerState(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  persistence: ContainerContentsPersistence;\n  recipientUserId: string;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientUserId,\n    subjectType: \"user\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with user ${input.recipientUserId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainer({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    previousProjection: shareContext.projection,\n    recipientUserId: input.recipientUserId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n\nexport async function shareContainerStateWithGroup(input: {\n  accessLevel: ContainerShareAccessLevel;\n  containerState: ContainerState;\n  expectedGroupName?: string | undefined;\n  knownContainerKeks?: ReadonlyMap<string, Uint8Array> | undefined;\n  persistence: ContainerContentsPersistence;\n  recipientGroupId: string;\n  // When set, a re-share only re-wraps an already-granted group and never mints\n  // a new grant. Used by organization access repair so a server cannot redirect\n  // the operation onto a container the group is not entitled to. A prepared\n  // re-wrap also supplies captured KEKs and must submit a real mutation.\n  requireExistingGrant?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerWorkflowRuntime;\n  stillCurrent?: (() => boolean) | undefined;\n}): Promise<SharedContainerStateResult | null> {\n  // A share chosen by name must carry that name so it can be bound to the\n  // signed group policy. Only the grant-preserving re-wrap, which never mints\n  // a grant, may run without one. Enforced here, in the workflow facade, so\n  // every caller (not only the store) meets the invariant.\n  if (!input.requireExistingGrant && input.expectedGroupName === undefined) {\n    throw new Error(\"Container group share requires the chosen group name\");\n  }\n  if (input.stillCurrent?.() === false) return null;\n  // Before the projection load and the share request: a hint that lands during\n  // either must keep the resulting projection out of the cache.\n  const writerProjectionGeneration = projectionGeneration(input.containerState);\n  const shareContext = await loadRemoteContainerShareContext({\n    accessLevel: input.accessLevel,\n    containerState: input.containerState,\n    expectedGroupName: input.expectedGroupName,\n    forceExistingGrantRewrap:\n      input.requireExistingGrant && input.knownContainerKeks !== undefined,\n    requireExistingGrant: input.requireExistingGrant,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n    subjectId: input.recipientGroupId,\n    subjectType: \"group\",\n  });\n  if (!shareContext || input.stillCurrent?.() === false) {\n    return null;\n  }\n  if (shareContext.matchingGrant) {\n    // A duplicate share mints nothing, but it must not report success for a\n    // group the user did not choose. A matching grant is only found after the\n    // key-epoch probe verified the group's policy with the chosen name bound,\n    // so the name is already checked here.\n    input.runtime.util.log(\n      `Container contents: skipped duplicate share for container ${input.containerState.container.id} with group ${input.recipientGroupId}`,\n    );\n    return persistDuplicateContainerShare({\n      containerState: input.containerState,\n      grant: shareContext.matchingGrant,\n      persistence: input.persistence,\n      projection: shareContext.projection,\n      runtime: input.runtime,\n      stillCurrent: input.stillCurrent,\n      writerProjectionGeneration,\n    });\n  }\n\n  const shared = await shareRemoteContainerWithGroup({\n    accessLevel: input.accessLevel,\n    containerId: input.containerState.container.id,\n    expectedGroupName: input.expectedGroupName,\n    knownContainerKeks: input.knownContainerKeks,\n    previousProjection: shareContext.projection,\n    recipientGroupId: input.recipientGroupId,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    runtime: input.runtime,\n    stillCurrent: input.stillCurrent,\n  });\n\n  if (!shared) return null;\n  if (input.stillCurrent?.() === false) return { status: \"confirmed\" };\n\n  return persistSharedContainerState({\n    containerState: input.containerState,\n    persistence: input.persistence,\n    runtime: input.runtime,\n    shared,\n    stillCurrent: input.stillCurrent,\n    writerProjectionGeneration,\n  });\n}\n"]}

package/workflows/container-contents/container-state/{sharePersistence.js → share/sharePersistence.js}

@@ -1,6 +1,6 @@
-import { persistContainerMetadataStateFromRuntime, } from "../metadata/index.js";
-import { createDetachedContainerMetadataState, installDetachedContainerMetadataState, } from "../metadata/metadataStateIsolation.js";
-import { installContainerWriterProjection } from "./projectionCache.js";
+import { persistContainerMetadataStateFromRuntime, } from "../../metadata/index.js";
+import { createDetachedContainerMetadataState, installDetachedContainerMetadataState, } from "../../metadata/metadataStateIsolation.js";
+import { installContainerWriterProjection } from "../projectionCache.js";
 // These helpers run only after the remote grant is verified. A skipped local
 // install does not undo that acknowledgement; reconciliation installs it later.
 export async function persistSharedContainerState(input) {